<!DOCTYPE html>
<html>
  <!-- meta/link... -->
  



<head>
  <meta http-equiv="content-type" content="text/html; charset=utf-8">
  <meta content="width=device-width, initial-scale=1.0, maximum-scale=1.0, user-scalable=0" name="viewport">
  <!-- Global site tag (gtag.js) - Google Analytics -->


  <title>ctf之web基础知识 | YY&#39;s Blog</title>

  <link rel="icon" type="image/jpeg" href="/medias/favicon.jpg">
  <link rel="stylesheet" href="https://at.alicdn.com/t/font_1911880_c1nvbyezg17.css">
  <link href="https://unpkg.com/@fortawesome/fontawesome-free/css/all.min.css" rel="stylesheet">
  <link href="/js/swiper/swiper@5.4.1.min.css" rel="stylesheet">
  
  
  
  
<link rel="stylesheet" href="/css/animate.min.css">

  
<link rel="stylesheet" href="/css/style.css">

  
  
    
<link rel="stylesheet" href="/js/fancybox/jquery.fancybox.min.css">

  
  
    
<link rel="stylesheet" href="/js/shareJs/share.min.css">

  
  <style>
        @media (max-width: 992px) {
            #waifu {
                display: none;
            }
        }
    </style>
    <script src="//cdn.bootcss.com/pace/1.0.2/pace.min.js"></script>
    <link href="//cdn.bootcss.com/pace/1.0.2/themes/pink/pace-theme-flash.css" rel="stylesheet">

    
        <script src="/js/valine/index.js"></script>
    

    <!-- import link -->
    
        
            
        
            
        
    
    <!-- import script -->
    
        
            <script>function blog_time() {window.setTimeout(blog_time,1000);const now = new Date();const copyrightTime = now.getFullYear();			display_copyright_time.innerHTML = " "+copyrightTime;}blog_time();</script>
        
            <script>function blog_live_time() {window.setTimeout(blog_live_time, 1000);const start = new Date('2020-10-01T00:00:00');const now = new Date();const timeDiff = (now.getTime() - start.getTime());					  const msPerMinute = 60 * 1000;					  const msPerHour = 60 * msPerMinute;					  const msPerDay = 24 * msPerHour;					  const passDay = Math.floor(timeDiff / msPerDay);					  const passHour = Math.floor((timeDiff % msPerDay) / 60 / 60 / 1000);					  const passMinute = Math.floor((timeDiff % msPerHour) / 60 / 1000);const passSecond = Math.floor((timeDiff % msPerMinute) / 1000);display_live_time.innerHTML = " " + passDay + " 天 " + passHour + " 小时 " + passMinute + " 分 " + passSecond + " 秒";}blog_live_time();</script>
        
    

    <!-- import daovoice -->
    

        <script>(function (i, s, o, g, r, a, m) {
            i['DaoVoiceObject'] = r;
            i[r] = i[r] ||
              function () {
                (i[r].q = i[r].q || []).push(arguments);
              };
            i[r].l = 1 * new Date();
            a = s.createElement(o);
            m = s.getElementsByTagName(o)[0];
            a.async = 1;
            a.src = g;
            a.charset = 'utf-8';
            m.parentNode.insertBefore(a, m);
          })(window, document, 'script', ('https:' === document.location.protocol ? 'https:' : 'http:') + "//widget.daovoice.io/widget/5a027b89.js", 'daovoice');
          daovoice('init', {
            app_id: "5a027b89",
          });
          daovoice('update');
        </script>
      
    
<meta name="generator" content="Hexo 5.4.0"></head>

  
  <!-- 依赖于jquery和vue -->
  
    
<script src="https://unpkg.com/jquery@3.5.1/dist/jquery.min.js"></script>

  

  
    
<script src="https://unpkg.com/vue@2.6.11/dist/vue.min.js"></script>

  
  
  <body>
    <!-- 预加载动画 -->
    <!-- 页面预加载动画 -->

<div id='loader'>
  <link rel="stylesheet" href="/js/loaded/index.css" >
  <div class="loading-left-bg"></div>
  <div class="loading-right-bg"></div>
  <div class="spinner-box">
    <div class="configure-border-1">
      <div class="configure-core"></div>
    </div>
    <div class="configure-border-2">
      <div class="configure-core"></div>
    </div>
    <div class="loading-word">加载中...</div>
  </div>
</div>

<script>
  var endLoading = function () {
    document.body.style.overflow = 'auto';
    document.getElementById('loader').classList.add("loading");
  }
  window.addEventListener('DOMContentLoaded',endLoading);
  
</script>

    
    <!-- 判断是否为暗黑风格 -->
    <!-- 判断是否为黑夜模式 -->
<script>
  let isDark = JSON.parse(localStorage.getItem('dark')) || JSON.parse('false');

  if (isDark) {
    $(document.body).addClass('darkModel');
  }
</script>

    <!-- 需要在上面加载的js -->
    <script>
  function loadScript(src, cb) {
    return new Promise(resolve => {
      setTimeout(function () {
        var HEAD = document.getElementsByTagName("head")[0] || document.documentElement;
        var script = document.createElement("script");
        script.setAttribute("type", "text/javascript");
        if (cb) {
          if (JSON.stringify(cb)) {
            for (let p in cb) {
              if (p == "onload") {
                script[p] = () => {
                  cb[p]()
                  resolve()
                }
              } else {
                script[p] = cb[p]
                script.onload = resolve
              }
            }
          } else {
            script.onload = () => {
              cb()
              resolve()
            };
          }
        } else {
          script.onload = resolve
        }
        script.setAttribute("src", src);
        HEAD.appendChild(script);
      });
    });
  }

  //https://github.com/filamentgroup/loadCSS
  var loadCSS = function (href, before, media, attributes) {
    return new Promise(resolve => {
      setTimeout(function () {
        var link = document.createElement('link');
        link.rel = "stylesheet";
        link.href = src;
        link.onload = resolve;
        document.getElementsByTagName("head")[0].appendChild(link);
      });
    });
  };

</script> 

<!-- 轮播图所需要的js -->
<script src="/js/swiper/swiper.min.js"></script>
<script src="/js/swiper/vue-awesome-swiper.js"></script>
<script src="/js/swiper/swiper.animate1.0.3.min.js"></script>

<script type="text/javascript">
  Vue.use(window.VueAwesomeSwiper)
</script>


  <script src="/js/vue-typed-js/index.js"></script>


<!-- 首页的公告滚动插件的js需要重新加载 -->
<script src="/js/vue-seamless-scroll/index.js"></script>

<!-- 打字机效果js -->
<script src="https://unpkg.com/typed.js@2.0.11"></script>


    <div id="safearea">
      <main class="main" id="pjax-container">
        <!-- 头部导航 -->
        
<header class="header   " 
  id="navHeader"
  style="position: fixed;
  left: 0; top: 0; z-index: 10;width: 100%;"
>
  <div class="header-content">
    <div class="bars">
      <div id="appDrawer" class="sidebar-image">
  <div class="drawer-box-icon">
    <i class="fas fa-bars" aria-hidden="true" @click="showDialogDrawer"></i>
  </div>
  
  <transition name="fade">
    <div class="drawer-box_mask" v-cloak style="display: none;" v-show="visible" @click.self="cancelDialogDrawer">
    </div>
  </transition>
  <div class="drawer-box" :class="{'active': visible}">
    <div class="drawer-box-head bg-color">
      <img class="drawer-box-head_logo lazyload placeholder" src="/medias/logo.png" class="lazyload placeholder" data-srcset="/medias/logo.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="logo">
      <h3 class="drawer-box-head_title">YY&#39;s Blog</h3>
      <h5 class="drawer-box-head_desc">三十年河东，三十年河西，莫欺少年穷！</h5>
    </div>
    
    <div class="drawer-box-content">
      <ul class="drawer-box-content_menu">
        
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/" class="drawer-menu-item-link">
                  
                    <i class="fa fa-home" aria-hidden="true"></i>
                  
                  <span class="name">首页</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/archives" class="drawer-menu-item-link">
                  
                    <i class="fa fa-archive" aria-hidden="true"></i>
                  
                  <span class="name">归档</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/tags" class="drawer-menu-item-link">
                  
                    <i class="fa fa-tags" aria-hidden="true"></i>
                  
                  <span class="name">标签</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/categories" class="drawer-menu-item-link">
                  
                    <i class="fa fa-bookmark" aria-hidden="true"></i>
                  
                  <span class="name">分类</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/about" class="drawer-menu-item-link">
                  
                    <i class="fa fa-user" aria-hidden="true"></i>
                  
                  <span class="name">关于</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/comments" class="drawer-menu-item-link">
                  
                    <i class="fa fa-comments" aria-hidden="true"></i>
                  
                  <span class="name">留言</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/friends" class="drawer-menu-item-link">
                  
                    <i class="fa fa-book" aria-hidden="true"></i>
                  
                  <span class="name">友情链接</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="/love" class="drawer-menu-item-link">
                  
                    <i class="fa fa-heart" aria-hidden="true"></i>
                  
                  <span class="name">Love</span>
                </a>
              
            </li>
          
            <li class="drawer-box-content_item" style="position: relative;">
              
                <a href="javascript:;" class="drawer-menu-item-link has-children" @click="openOrCloseMenu(8)">
                  <span>
                    
                      <i class="fa fa-link"></i>
                    
                    <span class="name">更多</span>
                  </span>
                  <i class="fas fa-chevron-left arrow " :class="{'icon-rotate': isOpen(8)}" aria-hidden="true"></i>
                </a>
                <ul class="drawer-sub-menu" v-if="isOpen(8)">
                  
                  <li>
                    <a href="/gallery">
                      
                      <i class="fa fa-music" style="margin-top: -20px;"></i>
                      
                      <span>图库</span>
                    </a>
                  </li>
                  
                  <li>
                    <a href="/me">
                      
                      <i class="fa fa-user" style="margin-top: -20px;"></i>
                      
                      <span>关于我</span>
                    </a>
                  </li>
                  
                  <li>
                    <a href="/resources">
                      
                      <i class="fa fa-film" style="margin-top: -20px;"></i>
                      
                      <span>资源</span>
                    </a>
                  </li>
                  
                  <li>
                    <a target="_blank" rel="noopener" href="http://baidu.com">
                      
                      <i class="fa fa-wifi" style="margin-top: -20px;"></i>
                      
                      <span>百度</span>
                    </a>
                  </li>
                  
                </ul>
              
            </li>
          
        
        
          <li class="drawer-box-content_item">
            <a target="_blank" rel="noopener" href="https://gitee.com/yangyang-linux">
              <i class="fas fa-github" aria-hidden="true"></i>
              <span>Github</span>
            </a>
          </li>
        
      </ul>
    </div>
  </div>
</div>

<script>
  var body = document.body || document.documentElement || window;
  var vm = new Vue({
    el: '#appDrawer',
    data: {
      visible: false,
      top: 0,
      openArr: [],
    },
    computed: {
    },
    mounted() {
    },
    methods: {
      isOpen(index) {
        if (this.openArr.includes(index)) {
          return true;
        } else {
          return false;
        }
      },
      openOrCloseMenu(curIndex) {
        const index = this.openArr.indexOf(curIndex);
        if (index !== -1) {
          this.openArr.splice(index, 1);
        } else {
          this.openArr.push(curIndex);
        }
      },
      showDialogDrawer() {
        this.visible = true;
        // 防止页面滚动，只能让弹框滚动
        this.top = $(document).scrollTop()
        body.style.cssText = 'width: 100%; height: 100%;overflow: hidden;';
      },
      cancelDialogDrawer() {
        this.visible = false;
        body.removeAttribute('style');
        $(document).scrollTop(this.top)
      }
    },
    created() {}
  })
</script>

    </div>
    <div class="blog-title" id="author-avatar">
      
        <div class="avatar">
          <img src="/medias/logo.png" class="lazyload placeholder" data-srcset="/medias/logo.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="logo">
        </div>
      
      <a href="/" class="logo">YY&#39;s Blog</a>
    </div>
    <nav class="navbar">
      <ul class="menu">
        
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/" class="menu-item-link" title="首页">
                  
                    <i class="fa fa-home" aria-hidden="true"></i>
                  
                  <span class="name">首页</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/archives" class="menu-item-link" title="归档">
                  
                    <i class="fa fa-archive" aria-hidden="true"></i>
                  
                  <span class="name">归档</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/tags" class="menu-item-link" title="标签">
                  
                    <i class="fa fa-tags" aria-hidden="true"></i>
                  
                  <span class="name">标签</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/categories" class="menu-item-link" title="分类">
                  
                    <i class="fa fa-bookmark" aria-hidden="true"></i>
                  
                  <span class="name">分类</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/about" class="menu-item-link" title="关于">
                  
                    <i class="fa fa-user" aria-hidden="true"></i>
                  
                  <span class="name">关于</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/comments" class="menu-item-link" title="留言">
                  
                    <i class="fa fa-comments" aria-hidden="true"></i>
                  
                  <span class="name">留言</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/friends" class="menu-item-link" title="友情链接">
                  
                    <i class="fa fa-book" aria-hidden="true"></i>
                  
                  <span class="name">友情链接</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="/love" class="menu-item-link" title="Love">
                  
                    <i class="fa fa-heart" aria-hidden="true"></i>
                  
                  <span class="name">Love</span>
                </a>
              
            </li>
          
            <li class="menu-item" style="position: relative;">
              
                <a href="javascript:;" class="menu-item-link" title="更多">
                  
                    <i class="fa fa-link"></i>
                  
                  <span class="name">更多</span>
                  <i class="fas fa-chevron-down arrow" aria-hidden="true"></i>
                </a>
                <ul class="sub-menu">
                  
                  <li>
                    <a href="/gallery">
                      
                      <i class="fa fa-music" style="margin-top: -20px;"></i>
                      
                      <span>图库</span>
                    </a>
                  </li>
                  
                  <li>
                    <a href="/me">
                      
                      <i class="fa fa-user" style="margin-top: -20px;"></i>
                      
                      <span>关于我</span>
                    </a>
                  </li>
                  
                  <li>
                    <a href="/resources">
                      
                      <i class="fa fa-film" style="margin-top: -20px;"></i>
                      
                      <span>资源</span>
                    </a>
                  </li>
                  
                  <li>
                    <a target="_blank" rel="noopener" href="http://baidu.com">
                      
                      <i class="fa fa-wifi" style="margin-top: -20px;"></i>
                      
                      <span>百度</span>
                    </a>
                  </li>
                  
                </ul>
              
            </li>
          
        
      </ul>
      
      
        <div id="appSearch">
  <div class="search"  @click="showDialog()"><i class="fas fa-search" aria-hidden="true"></i></div>
  <transition name="fade">
    <div class="message-box_wrapper" style="display: none;" v-cloak v-show="dialogVisible" @click.self="cancelDialogVisible()">
      <div class="message-box animated bounceInDown">
        <h2>
          <span>
            <i class="fas fa-search" aria-hidden="true"></i>
            <span class="title">本地搜索</span>
          </span>
          <i class="fas fa-times close" pointer style="float:right;" aria-hidden="true" @click.self="cancelDialogVisible()"></i>
        </h2>
        <form class="site-search-form">
          <input type="text"
            placeholder="请输入关键字"
            id="local-search-input" 
            @click="getSearchFile()"
            class="st-search-input"
            v-model="searchInput"
          />
        </form>
        <div class="result-wrapper">
          <div id="local-search-result" class="local-search-result-cls"></div>
        </div>
      </div>
    </div>
  </transition>
</div>
<script src="/js/local_search.js"></script>
<script>
  var body = document.body || document.documentElement || window;
  var vm = new Vue({
    el: '#appSearch',
    data: {
      dialogVisible: false,
      searchInput: '',
      top: 0,
    },
    computed: {
    },
    mounted() {
      window.addEventListener('pjax:complete', () => {
        this.cancelDialogVisible();
      })
    },
    methods: {
      showDialog() {
        this.dialogVisible = true;
        // 防止页面滚动，只能让弹框滚动
        this.top = $(document).scrollTop()
        body.style.cssText = 'overflow: hidden;';
      },
      getSearchFile() {
        if (!this.searchInput) {
          getSearchFile("/search.xml");
        }
      },
      cancelDialogVisible() {
        this.dialogVisible = false;
        body.removeAttribute('style');
        $(document).scrollTop(this.top)
      },
    },
    created() {}
  })
</script>
<!-- 解决刷新页面闪烁问题，可以在元素上添加display: none, 或者用vue.extend方法，详情：https://blog.csdn.net/qq_31393401/article/details/81017912 -->
<!-- 下面是搜索基本写法 -->
<!-- <script type="text/javascript" id="local.search.active">
  var inputArea = document.querySelector("#local-search-input");
  inputArea.onclick   = function(){ getSearchFile(); this.onclick = null }
  inputArea.onkeydown = function(){ if(event.keyCode == 13) return false }
</script> -->

      

    </nav>
  </div>
  
    <a target="_blank" rel="noopener" href="https://gitee.com/yangyang-linux" class="github-corner color-primary" aria-label="View source on GitHub"><svg width="60" height="60" viewBox="0 0 250 250" style="fill:#fff; position: absolute; top: 0; border: 0; right: 0;" aria-hidden="true"><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" fill="currentColor" style="transform-origin: 130px 106px;" class="octo-arm"></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" fill="currentColor" class="octo-body"></path></svg></a><style>.github-corner:hover .octo-arm{animation:octocat-wave 560ms ease-in-out}@keyframes octocat-wave{0%,100%{transform:rotate(0)}20%,60%{transform:rotate(-25deg)}40%,80%{transform:rotate(10deg)}}@media (max-width:500px){.github-corner:hover .octo-arm{animation:none}.github-corner .octo-arm{animation:octocat-wave 560ms ease-in-out}}</style>
  
  
    <div id="he-plugin-simple"></div>
    <script>
      WIDGET = {
        CONFIG: {
          "modules": "012",
          "background": 5,
          "tmpColor": "4A4A4A",
          "tmpSize": 16,
          "cityColor": "4A4A4A",
          "citySize": 16,
          "aqiSize": 16,
          "weatherIconSize": 24,
          "alertIconSize": 18,
          "padding": "10px 10px 10px 10px",
          "shadow": "1",
          "language": "auto",
          "borderRadius": 5,
          "fixed": "false",
          "vertical": "middle",
          "horizontal": "center",
          "key": "2784dd3fcb1e4f0f9a9b579bf69641f2"
        }
      }
    </script>
    <script src="https://widget.qweather.net/simple/static/js/he-simple-common.js?v=2.0"></script> 
    
</header>
        <!-- 内容区域 -->
        
 <!-- prismjs 代码高亮 -->
 


<div class="bg-dark-floor" style="position: fixed;left: 0;top: 0;width: 100%;height: 100%;z-index: -1;"></div>


  <!-- 文章详情页顶部图片和标题 -->




<div class="post-detail-header" id="thumbnail_canvas" style="background-repeat: no-repeat; background-size: cover; 
  background-position: center center;position: relative;background-image:url('/medias/13.jpg')">
  <div class="post-detail-header-mask"></div>
  <canvas id="header_canvas"style="position:absolute;bottom:0;pointer-events:none;"></canvas>
  
  <div class="post-detail-header_info-box">
    <div class="title-box">
      <span class="title">
        ctf之web基础知识
      </span>
    </div>
    
    
      
        <span class="post-detail-header_date">
          <i class="fas fa-calendar"></i> 发表于：2021-06-23 |
        </span>
      

      

      
        <div class="post-detail-header_wordcount">
          <span class="totalcount">
            <i class="fas fa-file-text-o"></i> 字数统计: 4.8k |
          </span>
  
          <span class="min2read">
            <i class="fas fa-clock"></i> 阅读时长: 19分钟 |
          </span>
  
          
            <span class="reading">
              <i class="fas fa-eye"></i> 阅读量：<span id="busuanzi_value_page_pv"></span>
            </span>
          
        </div>
      
    
  </div>
  
  
    <script src="/js/bubble/bubble.js"></script>
  
</div>





<div class="row justify-position" 
  style="padding-top: 0px;">
  <div class="main-content">
    <article class="post post-detail">
      <div class="post-content">
        <h1 id="一、基础知识"><a href="#一、基础知识" class="headerlink" title="一、基础知识"></a>一、基础知识</h1><ol>
<li>CTF 简介</li>
<li>竞赛模式</li>
<li>比赛形式</li>
<li>题目类型</li>
</ol>
<h1 id="二、web-前置技能"><a href="#二、web-前置技能" class="headerlink" title="二、web 前置技能"></a>二、web 前置技能</h1><h2 id="1-HTTP-协议"><a href="#1-HTTP-协议" class="headerlink" title="1. HTTP 协议"></a>1. HTTP 协议</h2><ol>
<li><p>请求方式</p>
<p><a target="_blank" rel="noopener" href="https://blog.csdn.net/qq_46222050/article/details/108159069">https://blog.csdn.net/qq_46222050/article/details/108159069</a></p>
<p><a target="_blank" rel="noopener" href="http://www.ruanyifeng.com/blog/2019/09/curl-reference.html">http://www.ruanyifeng.com/blog/2019/09/curl-reference.html</a></p>
</li>
<li><p>302 跳转</p>
<p>HTTP临时重定向</p>
<p><a target="_blank" rel="noopener" href="https://www.jianshu.com/p/e56d9f0a5c09">https://www.jianshu.com/p/e56d9f0a5c09</a></p>
</li>
<li><p>cookie</p>
<p>Cookie欺骗、认证、伪造</p>
<p><a target="_blank" rel="noopener" href="https://www.cnblogs.com/webconfig/p/3623343.html">https://www.cnblogs.com/webconfig/p/3623343.html</a></p>
</li>
<li><p>基础认证</p>
<p>在HTTP中，基本认证（英语：Basic access authentication）是允许http用户代理（如：网页浏览器）在请求时，提供 用户名 和 密码 的一种方式。详情请查看 <a target="_blank" rel="noopener" href="https://zh.wikipedia.org/wiki/HTTP%E5%9F%BA%E6%9C%AC%E8%AE%A4%E8%AF%81">https://zh.wikipedia.org/wiki/HTTP基本认证</a></p>
</li>
</ol>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> base64</span><br><span class="line">fp = <span class="built_in">open</span>(<span class="string">&#x27;pinjie.txt&#x27;</span>,<span class="string">&#x27;w&#x27;</span>)</span><br><span class="line"><span class="keyword">with</span> <span class="built_in">open</span>(<span class="string">&quot;1000-top.txt&quot;</span>, <span class="string">&quot;r&quot;</span>) <span class="keyword">as</span> f:</span><br><span class="line">	<span class="keyword">for</span> line <span class="keyword">in</span> f.readlines():</span><br><span class="line">		line = line.strip(<span class="string">&#x27;\n&#x27;</span>)</span><br><span class="line">		line = <span class="string">&#x27;admin:&#x27;</span>+line</span><br><span class="line">		<span class="built_in">print</span> (line)</span><br><span class="line">		line1=base64.b64encode(line.encode(<span class="string">&#x27;utf-8&#x27;</span>))</span><br><span class="line">		<span class="comment">#print(str(line1,&#x27;utf-8&#x27;))</span></span><br><span class="line">		fp.write(<span class="built_in">str</span>(line1,<span class="string">&#x27;utf-8&#x27;</span>)+<span class="string">&#x27;\n&#x27;</span>)</span><br></pre></td></tr></table></figure>

<p>   burp 爆破</p>
<ol start="5">
<li>响应源代码<br>HTTP响应包源代码查看</li>
</ol>
<h2 id="2-操作系统"><a href="#2-操作系统" class="headerlink" title="2. 操作系统"></a>2. 操作系统</h2><h2 id="3-数据库"><a href="#3-数据库" class="headerlink" title="3. 数据库"></a>3. 数据库</h2><h2 id="4-HTML-CSS"><a href="#4-HTML-CSS" class="headerlink" title="4. HTML/CSS"></a>4. HTML/CSS</h2><h2 id="5-程序语言"><a href="#5-程序语言" class="headerlink" title="5. 程序语言"></a>5. 程序语言</h2><p>php、python、java</p>
<h1 id="三、Web-工具配置"><a href="#三、Web-工具配置" class="headerlink" title="三、Web 工具配置"></a>三、Web 工具配置</h1><p>虚拟机、burpsuite、firefox/chrome、webshell、菜刀类工具( 蚁剑、菜刀、c刀 )、端口扫描 (nmap、httpscan、msf)、远程连接(ssh、rdp)、目录爆破(御剑、dirmap、burp 等等，取决于字典的强大)</p>
<h1 id="四、信息泄露"><a href="#四、信息泄露" class="headerlink" title="四、信息泄露"></a>四、信息泄露</h1><h2 id="1-目录遍历"><a href="#1-目录遍历" class="headerlink" title="1. 目录遍历"></a>1. 目录遍历</h2><p>路径遍历攻击（也称为目录遍历）旨在访问存储在Web根文件夹之外的文件和目录。通过操纵带有“点-斜线（…）”序列及其变化的文件或使用绝对文件路径来引用文件的变量，可以访问存储在文件系统上的任意文件和目录，包括应用程序源代码、配置和关键系统文件。</p>
<p>apache 配置不当导致目录遍历，信息泄露。</p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BESsQ1"><img src="https://s1.ax1x.com/2020/10/23/BESsQ1.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BESsQ1.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BESsQ1.md.png"></a></p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> requests</span><br><span class="line"></span><br><span class="line"><span class="keyword">if</span> __name__ == <span class="string">&#x27;__main__&#x27;</span>:</span><br><span class="line">    url = <span class="string">&#x27;http://challenge-32f4e7a6b43eb48c.sandbox.ctfhub.com:10080/flag_in_here&#x27;</span></span><br><span class="line"></span><br><span class="line">    <span class="keyword">for</span> i <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">4</span>):</span><br><span class="line">        <span class="keyword">for</span> j <span class="keyword">in</span> <span class="built_in">range</span>(<span class="number">1</span>,<span class="number">4</span>):</span><br><span class="line">            new_url = url + <span class="string">&#x27;/&#x27;</span> + <span class="built_in">str</span>(i) + <span class="string">&#x27;/&#x27;</span> + <span class="built_in">str</span>(j)</span><br><span class="line">            <span class="built_in">print</span>(new_url)</span><br><span class="line">            page_text = requests.get(new_url).text</span><br><span class="line">            <span class="keyword">if</span> <span class="string">&quot;flag.txt&quot;</span> <span class="keyword">in</span> page_text:</span><br><span class="line">                <span class="built_in">print</span>(new_url)</span><br></pre></td></tr></table></figure>

<h2 id="2-phpinfo"><a href="#2-phpinfo" class="headerlink" title="2. phpinfo()"></a>2. phpinfo()</h2><p>phpinfo()  页面也是泄露信息的一种途径。</p>
<h2 id="3-备份文件下载"><a href="#3-备份文件下载" class="headerlink" title="3. 备份文件下载"></a>3. 备份文件下载</h2><ol>
<li><p>网站源码</p>
<p>当开发人员在线上环境中对源代码进行了备份操作，并且将备份文件放在了 web 目录下，就会引起网站源码泄露。</p>
<ul>
<li>常见的网站源码备份文件后缀<ul>
<li>tar</li>
<li>tar.gz</li>
<li>zip</li>
<li>rar</li>
</ul>
</li>
<li>常见的网站源码备份文件名<ul>
<li>web</li>
<li>website</li>
<li>backup</li>
<li>back</li>
<li>www</li>
<li>wwwrote</li>
<li>temp</li>
</ul>
</li>
</ul>
<p>直接御剑扫描，</p>
</li>
<li><p>bak 文件</p>
<p>当开发人员在线上环境中对源代码进行了备份操作，并且将备份文件放在了 web 目录下，就会引起网站源码泄露。</p>
<p>同样御剑扫描，但关键是字典。</p>
</li>
<li><p>vim 缓存</p>
<p>当开发人员在线上环境中使用 vim 编辑器，在使用过程中会留下 vim 编辑器缓存，当vim异常退出时，缓存会一直留在服务器上，引起网站源码泄露。</p>
<p><strong>在使用vim时会创建临时缓存文件，关闭vim时缓存文件则会被删除，当vim异常退出后，因为未处理缓存文件，导致可以通过缓存文件恢复原始文件内容。</strong></p>
<p>以 index.php 为例：</p>
<p>第一次产生的交换文件名为 <strong><code>.index.php.swp</code></strong></p>
<p>再次意外退出后，将会产生名为 <strong><code>.index.php.swo</code></strong> 的交换文件</p>
<p>第三次产生的交换文件则为 <strong><code>.index.php.swn</code></strong></p>
</li>
<li><p>.DS_Store</p>
<p><code>.DS_Store</code> 是 Mac OS 保存文件夹的自定义属性的隐藏文件。通过.DS_Store可以知道这个目录里面所有文件的清单。</p>
<p>.DS_Store(英文全称 Desktop Services Store)是一种由苹果公司的Mac OS X操作系统所创造的隐藏文件，目的在于存贮目录的自定义属性，例如文件的图标位置或者是背景色的选择。相当于 Windows 下的 desktop.ini。</p>
<p>直接 linux  <code>cat</code> 打开</p>
<p>或者实用工具 <a target="_blank" rel="noopener" href="https://github.com/gehaxelt/Python-dsstore">https://github.com/gehaxelt/Python-dsstore</a></p>
</li>
</ol>
<h2 id="4-Git-泄露"><a href="#4-Git-泄露" class="headerlink" title="4. Git 泄露"></a>4. Git 泄露</h2><ol>
<li><p>log</p>
<p>当前大量开发人员使用git进行版本控制，对站点自动部署。如果配置不当,可能会将 <code>.git</code> 文件夹直接部署到线上环境。这就引起了 <code>git泄露漏洞</code>。</p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BENkfU"><img src="https://s1.ax1x.com/2020/10/23/BENkfU.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BENkfU.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BENkfU.md.png"></a></p>
<p>使用 <code>githack</code> 恢复。</p>
<p><a target="_blank" rel="noopener" href="https://github.com/WangYihang/GitHacker">https://github.com/WangYihang/GitHacker</a></p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">python2 GitHack.py http://challenge-2c6696d984cb9239.sandbox.ctfhub.com:<span class="number">10080</span>/.git/</span><br></pre></td></tr></table></figure>

<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BEsYjK"><img src="https://s1.ax1x.com/2020/10/23/BEsYjK.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BEsYjK.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BEsYjK.md.png"></a></p>
<p>处理得到：</p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BEswAH"><img src="https://s1.ax1x.com/2020/10/23/BEswAH.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BEswAH.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BEswAH.md.png"></a></p>
<p>查看历史记录 <code>git log</code> </p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br></pre></td><td class="code"><pre><span class="line">D:\ctf\GitHack-master\dist\challenge-2c6696d984cb9239.sandbox.ctfhub.com_10080&gt;git <span class="built_in">log</span></span><br><span class="line">commit ea5a516f056ccb783834f9f98fa422b60a41c780 (HEAD -&gt; master)</span><br><span class="line">Author: CTFHub &lt;sandbox@ctfhub.com&gt;</span><br><span class="line">Date:   Fri Oct 23 15:11:17 2020 +0000</span><br><span class="line"></span><br><span class="line">    remove flag</span><br><span class="line"></span><br><span class="line">commit 3874ed3aca9e6ba2698716dbbaed7822e269301e</span><br><span class="line">Author: CTFHub &lt;sandbox@ctfhub.com&gt;</span><br><span class="line">Date:   Fri Oct 23 15:11:17 2020 +0000</span><br><span class="line"></span><br><span class="line">    add flag</span><br><span class="line"></span><br><span class="line">commit f3c62ee6aa578cf6ce3ddb1c6e4eac7d739b2125</span><br><span class="line">Author: CTFHub &lt;sandbox@ctfhub.com&gt;</span><br><span class="line">Date:   Fri Oct 23 15:11:17 2020 +0000</span><br><span class="line"></span><br><span class="line">    init</span><br><span class="line"></span><br><span class="line">D:\ctf\GitHack-master\dist\challenge-2c6696d984cb9239.sandbox.ctfhub.com_10080&gt;</span><br></pre></td></tr></table></figure>

<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BEyAVe"><img src="https://s1.ax1x.com/2020/10/23/BEyAVe.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BEyAVe.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BEyAVe.md.png"></a></p>
<p>当前所处版本为 <code>remove flag</code> ，flag 应该在 <code>add flag</code> 这里。</p>
<p>于 <code>add flag</code> 进行比对， <code>3874ed3aca9e6ba2698716dbbaed7822e269301e</code></p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BEyG5j"><img src="https://s1.ax1x.com/2020/10/23/BEyG5j.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BEyG5j.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BEyG5j.md.png"></a></p>
<p>看到之前被删掉的 falg 了。</p>
<p>另一种方法：</p>
<p>直接切换到 <code>add flag</code> 版本。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">git reset --hard 3874ed3aca9e6ba2698716dbbaed7822e269301e</span><br></pre></td></tr></table></figure>

<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BEytGn"><img src="https://s1.ax1x.com/2020/10/23/BEytGn.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BEytGn.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BEytGn.md.png"></a></p>
<p>可以看到目录里可以看到了flag的文件。</p>
</li>
<li><p>stash</p>
<p>当前大量开发人员使用git进行版本控制，对站点自动部署。如果配置不当,可能会将.git文件夹直接部署到线上环境。这就引起了git泄露漏洞。</p>
<p>同样使用Githack工具处理git泄露情况。</p>
<p>git stash是git一个很有用的命令，它的作用是把当前未提交的修改暂存起来，让仓库还原到最后一次提交的状态。常用于更新、同步代码或者保存多个修改版本等情况下。</p>
<p><a target="_blank" rel="noopener" href="https://jingyan.baidu.com/article/49ad8bceacac6b5834d8fa9a.html">https://jingyan.baidu.com/article/49ad8bceacac6b5834d8fa9a.html</a></p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">git stash	# git stash命令会将仓库中的修改保存，建立一条stash信息，默认的说明信息是最后一次提交的节点号和提交说明。</span><br><span class="line">git stash save #‘说明信息’与1的效果一样，说明信息是指定的内容，更加利于了解stash的内容。</span><br><span class="line">git stash list #列出当前仓库下所有的stash条目，每一条stash用stash@&#123;n&#125;标识。</span><br><span class="line">git stash pop [stash] # 将stash的内容弹出，默认弹出最上面的那条，即stash@&#123;0&#125;。此外还可以在pop后加stash@&#123;n&#125;来指定要弹出的stash条目。</span><br><span class="line">git stash drop [stash] #丢弃stash条目，默认丢弃最上面的那条，即stash@&#123;0&#125;，此外还可以在drop后加stash@&#123;n&#125;来指定要丢弃的stash条目。</span><br><span class="line">git stash clear #清除所有的stash条目。</span><br><span class="line">git show stash@&#123;n&#125;	#当有多条记录并且过了一段时间忘记stash内容时通过该命令可以查看stash的具体内容</span><br></pre></td></tr></table></figure>

<p>这里执行</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">git stash list</span><br><span class="line">git stash pop</span><br></pre></td></tr></table></figure>

<p>就恢复了falg 文件</p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BE6KY9"><img src="https://s1.ax1x.com/2020/10/23/BE6KY9.md.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/23/BE6KY9.md.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BE6KY9.md.png"></a></p>
<p>同样之前的方法也可以解题。</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">git log</span><br><span class="line">git diff .......</span><br></pre></td></tr></table></figure></li>
<li><p>index</p>
<p>githack 恢复之后就在文件中。。。。</p>
</li>
</ol>
<h2 id="5-SVN-泄露"><a href="#5-SVN-泄露" class="headerlink" title="5. SVN 泄露"></a>5. SVN 泄露</h2><p>当开发人员使用 SVN 进行版本控制，对站点自动部署。如果配置不当,可能会将.svn文件夹直接部署到线上环境。这就引起了 SVN 泄露漏洞。</p>
<p>版本控制系统<br> 集中式版本控制系统：Subversion(SVN)、CVS、VSS 等。<br> 分布式版本控制系统：Git、Mercurial(Hg) 等。<br> 具体区别比较可以看这个文章<a target="_blank" rel="noopener" href="https://www.cnblogs.com/likebeta/archive/2012/12/18/2822805.html">https://www.cnblogs.com/likebeta/archive/2012/12/18/2822805.html</a></p>
<p>使用 <code>dvcs-ripper</code></p>
<p><a target="_blank" rel="noopener" href="https://github.com/kost/dvcs-ripper">https://github.com/kost/dvcs-ripper</a></p>
<ul>
<li>安装：<code>sudo apt-get install perl libio-socket-ssl-perl libdbd-sqlite3-perl libclass-dbi-perl libio-all-lwp-perl</code></li>
<li>gitclone: <code>git clone https://github.com/kost/dvcs-ripper</code></li>
<li>进入目录</li>
<li>用 <code>./rip-svn.pl -v -u http://challenge-fb13f9afd9ee3b28.sandbox.ctfhub.com:10080/.svn/</code></li>
</ul>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">root@localhost:~/ctf/dvcs-ripper<span class="comment"># ./rip-svn.pl -v -u http://challenge-ef41833848c08d6d.sandbox.ctfhub.com:10080/.svn/</span></span><br><span class="line">[i] Found new SVN client storage format!</span><br><span class="line">REP INFO =&gt; 1:file:///opt/svn/ctfhub:e43e7ef8-82fb-4194-9673-81c29de69c33</span><br><span class="line">[i] Trying to revert the tree, <span class="keyword">if</span> you get error, upgrade your SVN client!</span><br><span class="line">已恢复“index.html”</span><br><span class="line"></span><br><span class="line">root@localhost:~/ctf/dvcs-ripper<span class="comment"># cat .svn/pristine/0c/0c5fb19b977dbe3945402427c5a732cb2d1d820a.svn-base </span></span><br><span class="line">ctfhub&#123;7db562e25eb73483a9d6e5aaa9265c8a01ce423f&#125;</span><br><span class="line"></span><br></pre></td></tr></table></figure>



<p>使用svn checkout后，项目目录下会生成隐藏的.svn文件夹（Linux上用ls命令看不到，要用ls -al命令）。<br> svn1.6及以前版本会在项目的每个文件夹下都生成一个.svn文件夹，里面包含了所有文件的备份，文件名为  .svn/text-base/文件名.svn-base<br> svn1.7及以后版本则只在项目根目录生成一个.svn文件夹，里面的pristine文件夹里包含了整个项目的所有文件备份.</p>
<h2 id="6-HG泄露"><a href="#6-HG泄露" class="headerlink" title="6. HG泄露"></a>6. HG泄露</h2><p>当开发人员使用 Mercurial 进行版本控制，对站点自动部署。如果配置不当,可能会将.hg 文件夹直接部署到线上环境。这就引起了 hg 泄露漏洞。</p>
<p>目录扫描有<code>/.hg/</code>  泄露 </p>
<p>还是上一个脚本库里的 rip-hg.pl</p>
<figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br><span class="line">19</span><br><span class="line">20</span><br><span class="line">21</span><br><span class="line">22</span><br><span class="line">23</span><br><span class="line">24</span><br><span class="line">25</span><br><span class="line">26</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">#一定要加 -v 不然 down 不下来的</span></span><br><span class="line">        </span><br><span class="line">root@localhost:~/ctf/dvcs-ripper<span class="comment"># ./rip-hg.pl -v -u http://challenge-1ccbdf6a8520678e.sandbox.ctfhub.com:10080/.hg/</span></span><br><span class="line">[i] Downloading hg files <span class="keyword">from</span> http://challenge-1ccbdf6a8520678e.sandbox.ctfhub.com:<span class="number">10080</span>/.hg/</span><br><span class="line">[i] Auto-detecting <span class="number">404</span> <span class="keyword">as</span> <span class="number">200</span> <span class="keyword">with</span> <span class="number">3</span> requests</span><br><span class="line">[i] Getting correct <span class="number">404</span> responses</span><br><span class="line">[d] found 00changelog.i</span><br><span class="line">[d] found dirstate</span><br><span class="line">[d] found requires</span><br><span class="line">[!] Not found <span class="keyword">for</span> branch: <span class="number">404</span> Not Found</span><br><span class="line">[!] Not found <span class="keyword">for</span> branchheads.cache: <span class="number">404</span> Not Found</span><br><span class="line">[d] found last-message.txt</span><br><span class="line">[!] Not found <span class="keyword">for</span> tags.cache: <span class="number">404</span> Not Found</span><br><span class="line">[d] found undo.branch</span><br><span class="line">[d] found undo.desc</span><br><span class="line">[d] found undo.dirstate</span><br><span class="line">[d] found store/00changelog.i</span><br><span class="line">[!] Not found <span class="keyword">for</span> store/00changelog.d: <span class="number">404</span> Not Found</span><br><span class="line">[d] found store/00manifest.i</span><br><span class="line">[!] Not found <span class="keyword">for</span> store/00manifest.d: <span class="number">404</span> Not Found</span><br><span class="line">[d] found store/fncache</span><br><span class="line">[d] found store/undo</span><br><span class="line">[!] Not found <span class="keyword">for</span> .hgignore: <span class="number">404</span> Not Found</span><br><span class="line">[i] Running hg status to check <span class="keyword">for</span> missing items</span><br><span class="line">cannot find hg: No such file <span class="keyword">or</span> directory at ./rip-hg.pl line <span class="number">140.</span></span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>执行过程有大量文件未找到，查看已旦拿到文件。</p>
<p>进入 <code>store</code> 目录·，查看 <code>fncache</code> 信息</p>
<figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">root@localhost:~/ctf/dvcs-ripper/.hg<span class="comment"># ls -a</span></span><br><span class="line">.  ..  00changelog.i  dirstate  last-message.txt  requires  store  undo.branch  undo.desc  undo.dirstate</span><br><span class="line">root@localhost:~/ctf/dvcs-ripper/.hg<span class="comment"># cat store/fncache </span></span><br><span class="line">data/index.html.i</span><br><span class="line">data/50x.html.i</span><br><span class="line">data/flag_32013795.txt.i</span><br><span class="line"></span><br></pre></td></tr></table></figure>

<p>根据页面提示，手工查看得到 Flag.</p>
<p><a target="_blank" rel="noopener" href="http://challenge-1ccbdf6a8520678e.sandbox.ctfhub.com:10080/flag_32013795.txt">http://challenge-1ccbdf6a8520678e.sandbox.ctfhub.com:10080/flag_32013795.txt</a></p>
<h1 id="五、密码口令"><a href="#五、密码口令" class="headerlink" title="五、密码口令"></a>五、密码口令</h1><h2 id="1-弱口令"><a href="#1-弱口令" class="headerlink" title="1. 弱口令"></a>1. 弱口令</h2><p>通常认为容易被别人（他们有可能对你很了解）猜测到或被破解工具破解的口令均为弱口令。</p>
<p>拿字典 burp 爆破即可。</p>
<h2 id="2-默认口令"><a href="#2-默认口令" class="headerlink" title="2. 默认口令"></a>2. 默认口令</h2><p>常见设备默认口令.</p>
<p>然后根据题目里的设备，对应去找一下默认口令就可以.</p>
<p><a target="_blank" rel="noopener" href="https://imgchr.com/i/BER7vR"><img src="https://s1.ax1x.com/2020/10/24/BER7vR.png" class="lazyload placeholder" data-srcset="https://s1.ax1x.com/2020/10/24/BER7vR.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="BER7vR.png"></a></p>
<h2 id="3-社会工程"><a href="#3-社会工程" class="headerlink" title="3. 社会工程"></a>3. 社会工程</h2><p>根据信息收集，然后制作相关字典。</p>
<p>姓名、电话、qq等.</p>
<h1 id="六、sql注入"><a href="#六、sql注入" class="headerlink" title="六、sql注入"></a>六、sql注入</h1><h1 id="七、XSS"><a href="#七、XSS" class="headerlink" title="七、XSS"></a>七、XSS</h1><p>XSS全称：跨站脚本（Cross Site Scripting）,为了不和层叠样式表（Cascading Style Sheets）的缩写CSS混合，所以改名为XSS；攻击者会向web页面（input表单、URL、留言版等位置）插入恶意JavaScript代码，导致管理员/用户访问时触发，从而达到攻击者的目的。</p>
<blockquote>
<p>攻击者往Web页面里插入恶意Script代码，当用户浏览该页之时，嵌入其中Web里面的Script代码会被执行，从而达到恶意攻击用户的目的</p>
</blockquote>
<p>XSS漏洞的大致分类</p>
<ol>
<li>反射性</li>
<li>存储型</li>
<li>DOM型</li>
</ol>
<p><img src="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828163943495.png" class="lazyload placeholder" data-srcset="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828163943495.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="image-20210828163943495"></p>
<p><img src="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828164040392.png" class="lazyload placeholder" data-srcset="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828164040392.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="image-20210828164040392"></p>
<h2 id="CTF中XSS题型套路总结"><a href="#CTF中XSS题型套路总结" class="headerlink" title="CTF中XSS题型套路总结"></a>CTF中XSS题型套路总结</h2><ul>
<li>给管理员发一条留言好吗？–存储型xss</li>
<li>提交网站漏洞，只限本站内的url，管理员会后台查看–反射性&amp;DOM XSS</li>
<li>动态执行JavaScript语句，更改dom树结构–DOM XSS</li>
<li>加载图片处，编辑用户名处–反射性XSS</li>
<li>进阶1–&gt;缓存投毒XSS–&gt;获取管理员Cookie</li>
<li>进阶2–&gt;Bypass CSP–&gt;获取管理员Cookie</li>
<li>冷门–&gt;XSS to RCE–&gt;获取系统flag</li>
</ul>
<p>svg缓存投毒：<a target="_blank" rel="noopener" href="https://xz.aliyun.com/t/4492">https://xz.aliyun.com/t/4492</a></p>
<p><a target="_blank" rel="noopener" href="https://developer.mozilla.org/zh-CN/docs/Web/Security/Same-origin_policy">浏览器的同源策略</a></p>
<h1 id="八、-文件上传"><a href="#八、-文件上传" class="headerlink" title="八、 文件上传"></a>八、 文件上传</h1><h2 id="介绍"><a href="#介绍" class="headerlink" title="介绍"></a>介绍</h2><p>文件上传漏洞是web安全中经常利用到的一种漏洞形式,一些web应用程序中允许上传图片，文本或者其他资源到指定的位置，文件上传漏洞就是利用这些可以上传的地方将恶意代码植入到服务器中，再通过url去访问以执行代码,在网站的运营过程中，不可避免地要对网站的某些页面或者内容进行更新，这时便需要使用到网站的文件上传的功能。</p>
<blockquote>
<p>造成文件上传漏洞的原因是</p>
<p>对于上传文件的后缀名（扩展名）没有做较为严格的限制</p>
<p>对于上传文件的MIMETYPE 没有做检查</p>
<p>权限上没有对于上传的文件的文件权限，（尤其是对于shebang类型的文件）</p>
<p>对于web server对于上传文件或者指定目录的行为没有做限制</p>
</blockquote>
<h2 id="绕过小技巧"><a href="#绕过小技巧" class="headerlink" title="绕过小技巧"></a>绕过小技巧</h2><h3 id="1-前端限制"><a href="#1-前端限制" class="headerlink" title="1.前端限制"></a><strong>1.前端限制</strong></h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">function check()&#123;</span><br><span class="line">        var filename=document.getElementById(&quot;file&quot;);</span><br><span class="line">        var str=filename.value.split(&quot;.&quot;);</span><br><span class="line">        var ext=str[str.length-1];</span><br><span class="line">        if(ext==&#x27;jpg&#x27;||ext==&#x27;png&#x27;||ext==&#x27;jpeg&#x27;||ext==&#x27;gif&#x27;)&#123;</span><br><span class="line">            return true;</span><br><span class="line">        &#125;else&#123;</span><br><span class="line">            alert(&quot;这不是图片！&quot;)</span><br><span class="line">            return false;</span><br><span class="line">        &#125;</span><br><span class="line">        return false;</span><br><span class="line">    &#125;</span><br></pre></td></tr></table></figure>

<p>在表单中使用onsumbit=check()调用js函数来检查上传文件的扩展名。这种限制实际上没有任何用处，只能用于对于用户完全信任的情况下，很难称之为一种安全措施只能称之是一种防止用户误操作上传的措施</p>
<p>绕过:抓包或者前端修改函数的值</p>
<h3 id="2-检测拓展名"><a href="#2-检测拓展名" class="headerlink" title="2.检测拓展名"></a><strong>2.检测拓展名</strong></h3><p>文件被上传到服务端的时候，对于文件名的扩展名进行检查，如果不合法，则拒绝这次上传,一般有两种策略:黑名单和白名单,白名单策略是更加安全的，通过限制上传类型为只有我们接受的类型，可以较好的保证安全，因为黑名单我们可以使用各种方法来进行注入和突破</p>
<p>黑名单:</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">$postfix = end(explode(&#x27;.&#x27;,&#x27;$_POST[&#x27;filename&#x27;]);</span><br><span class="line">if($postfix==&#x27;php&#x27;||$postfix==&#x27;asp&#x27;||$postfix==&#x27;sh&#x27;)&#123;</span><br><span class="line">  echo &quot;invalid file type&quot;;</span><br><span class="line">  return;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<p>白名单:</p>
<figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">$postfix = end(explode(&#x27;.&#x27;,&#x27;$_POST[&#x27;filename&#x27;]);</span><br><span class="line">if($postfix==&#x27;jpg&#x27;||$postfix==&#x27;png&#x27;||$postfix==&#x27;gif&#x27;)&#123;</span><br><span class="line">  //save the file and do something next</span><br><span class="line">&#125; else &#123;</span><br><span class="line">  echo &quot;invalid file type&quot;;</span><br><span class="line">  return;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure>

<h3 id="绕过"><a href="#绕过" class="headerlink" title="绕过:"></a>绕过:</h3><blockquote>
<ol>
<li>老版本的IIS中的目录解析漏洞，如果网站目录中有一个 /.asp/目录，那么此目录下面的一切内容都会被当作asp脚本来解析</li>
<li>老板本的IIS中的分号漏洞：IIS在解析文件名的时候可能将分号后面的内容丢弃，那么我们可以在上传的时候给后面加入分号内容来避免黑名单过滤，如 a.asp;jpg</li>
<li>旧版Windows Server中存在空格和dot漏洞类似于 a.php. 和 a.php[空格] 这样的文件名存储后会被windows去掉点和空格，从而使得加上这两个东西可以突破过滤，成功上传，并且被当作php代码来执行</li>
<li>nginx空字节漏洞 xxx.jpg%00.php 这样的文件名会被解析为php代码运行</li>
<li>apache的解析漏洞，上传如a.php.rar a.php.gif 类型的文件名，可以避免对于php文件的过滤机制，但是由于apache在解析文件名的时候是从右向左读，如果遇到不能识别的扩展名则跳过，rar等扩展名是apache不能识别的，因此就会直接将类型识别为php，从而达到了注入php代码的目的</li>
</ol>
</blockquote>
<h3 id="3-检查HTTP-Header中的Content-Type"><a href="#3-检查HTTP-Header中的Content-Type" class="headerlink" title="3.检查HTTP Header中的Content-Type"></a><strong>3.检查HTTP Header中的Content-Type</strong></h3><p>HTTP协议规定了上传资源的时候在Header中加上一项文件的MIMETYPE，来识别文件类型，这个动作是由浏览器完成的，服务端可以检查此类型不过这仍然是不安全的,因为HTTP header可以被发出者或者中间人任意的修改.</p>
<p>绕过:比如我们可以用burpsuite抓包将请求报文中的Content-Type: application/php修改为</p>
<p>Content-Type: image/jpg,</p>
<p>Content-Type: image/png,</p>
<p>Content-Type: text/plain这些都可以</p>
<p>附上常用的MIMETYPE表</p>
<blockquote>
<p>text/plain（纯文本）</p>
<p>text/html（HTML文档）</p>
<p>text/javascript（js代码）</p>
<p>application/xhtml+xml（XHTML文档）</p>
<p>image/gif（GIF图像）</p>
<p>image/jpeg（JPEG图像）</p>
<p>image/png（PNG图像）</p>
<p>video/mpeg（MPEG动画）</p>
<p>application/octet-stream（二进制数据）</p>
<p>application/pdf（PDF文档）</p>
<p>application/(编程语言) 该种语言的代码</p>
<p>application/msword（Microsoft Word文件）</p>
<p>message/rfc822（RFC 822形式）</p>
<p>multipart/alternative（HTML邮件的HTML形式和纯文本形式，相同内容使用不同形式表示）</p>
<p>application/x-www-form-urlencoded（POST方法提交的表单）</p>
<p>multipart/form-data（POST提交时伴随文件上传的表单）</p>
</blockquote>
<h2 id="题目"><a href="#题目" class="headerlink" title="题目"></a>题目</h2><div class="video"><video controls preload><source src='https://static-v.zhishibox.net/20210115/103186501.mp4' type='video/mp4'>Your browser does not support the video tag.</video></div>


<p>文件上传：<a target="_blank" rel="noopener" href="https://blog.csdn.net/qq_41079177/article/details/89386741">https://blog.csdn.net/qq_41079177/article/details/89386741</a></p>
<p>利用最新Apache解析漏洞（CVE-2017-15715）绕过上传黑名单：<a target="_blank" rel="noopener" href="https://www.leavesongs.com/PENETRATION/apache-cve-2017-15715-vulnerability.html">https://www.leavesongs.com/PENETRATION/apache-cve-2017-15715-vulnerability.html</a></p>
<h1 id="九、RCE"><a href="#九、RCE" class="headerlink" title="九、RCE"></a>九、RCE</h1><h1 id="十、SSRF"><a href="#十、SSRF" class="headerlink" title="十、SSRF"></a>十、SSRF</h1><blockquote>
<h2 id="介绍-1"><a href="#介绍-1" class="headerlink" title="介绍"></a><strong>介绍</strong></h2><p>ssrf(Server-Side Request Forgery:服务器端请求伪造): 是一种由攻击者构造形成由服务端发起请求的一个安全漏洞。一般情况下，SSRF攻击的目标是从外网无法访问的内部系统。（正是因为它是由服务端发起的，所以它能够请求到与它相连而与外网隔离的内部系统）</p>
<h2 id="成因"><a href="#成因" class="headerlink" title="成因"></a><strong>成因</strong></h2><p>都是由于服务端提供了从其他服务器应用获取数据的功能且没有对目标地址做过滤与限制。</p>
<p>也就是说，对于为服务器提供服务的其他应用没有对访问进行限制，如果我构造好我的访问包，那我就有可能利用目标服务对他的其他服务器应用进行调用。</p>
</blockquote>
<h2 id="SSRF-漏洞出现的场景"><a href="#SSRF-漏洞出现的场景" class="headerlink" title="SSRF 漏洞出现的场景"></a><strong>SSRF 漏洞出现的场景</strong></h2><ol>
<li><p>能够对外发起网络请求的地方，就可能存在 SSRF 漏洞</p>
</li>
<li><p>从远程服务器请求资源（Upload from URL，Import &amp; Export RSS Feed）</p>
</li>
<li><p>数据库内置功能（Oracle、MongoDB、MSSQL、Postgres、CouchDB）</p>
</li>
<li><p>Webmail 收取其他邮箱邮件（POP3、IMAP、SMTP）</p>
</li>
<li><p>文件处理、编码处理、属性信息处理（ffmpeg、ImageMagic、DOCX、PDF、XML）</p>
</li>
</ol>
<p><img src="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828171016095.png" class="lazyload placeholder" data-srcset="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210828171016095.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="image-20210828171016095"></p>
<h1 id="十一、XXE"><a href="#十一、XXE" class="headerlink" title="十一、XXE"></a>十一、XXE</h1><h2 id="XML"><a href="#XML" class="headerlink" title="XML"></a><strong>XML</strong></h2><p>XML 指可扩展标记语言（eXtensible Markup Language）。</p>
<p>方便大家理解，这里与HTML对比着给大家说一下：HTML和XML 为不同的目的而设计，HTML 被设计用来显示数据，其焦点是数据的外观。XML 被设计用来传输和存储数据，其焦点是数据的内容。HTML 旨在显示信息，而 XML 旨在传输信息。</p>
<h2 id="DTD"><a href="#DTD" class="headerlink" title="DTD"></a><strong>DTD</strong></h2><p>DTD（文档类型定义）的作用是定义 XML 文档的合法构建模块。</p>
<p>DTD的声明：指XML文档中声明该文档的DTD或DTD来源的部分，可以包含在使用它的XML文档内部，也可以以独立的DTD文档（*.dtd）文档存在。</p>
<p>所以DTD一般认为有两种引用或声明方式：</p>
<p>1.内部DTD：即对XML文档中的元素、属性和实体的DTD的声明都在XML文档中</p>
<p>2.外部DTD：即对XML文档中的元素、属性和实体的DTD的声明都在一个独立的DTD文件（.dtd)中</p>
<h2 id="XML基本文档结构"><a href="#XML基本文档结构" class="headerlink" title="XML基本文档结构"></a><strong>XML基本文档结构</strong></h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">&lt;!--XML声明--&gt;</span><br><span class="line">&lt;?xml version=&quot;1.0&quot; encoding=&quot;UTF-8&quot;?&gt;</span><br><span class="line">&lt;!--DTD，这部分可选的--&gt;          </span><br><span class="line">&lt;!DOCTYPE foo [ </span><br><span class="line">&lt;!ELEMENT foo ANY &gt;</span><br><span class="line">&lt;!ENTITY xxe SYSTEM &quot;file:///c:/windows/win.ini&quot; &gt;</span><br><span class="line">]&gt;</span><br><span class="line">&lt;!--文档元素--&gt;                                                                          </span><br><span class="line">&lt;foo&gt;&amp;xxe;&lt;/foo&gt;</span><br></pre></td></tr></table></figure>

<h2 id="XXE漏洞介绍"><a href="#XXE漏洞介绍" class="headerlink" title="XXE漏洞介绍"></a><strong>XXE漏洞介绍</strong></h2><p>XXE Injection 即 XML External Entity Injection，也就是 XML 外部实体注入攻击.漏洞是在对非安全的外部实体数据进⾏行处理时引发的安全问题。</p>
<blockquote>
<p>在 XML 1.0 标准里，XML 文档结构里定义了实体（entity）这个概念.实体可以通过预定义在文档中调用，实体的标识符可访问本地或远程内容.如果在这个过程中引入了「污染」源，在对 XML 文档处理后则可能导致信息泄漏等安全问题。</p>
</blockquote>
<p><img src="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210829182944924.png" class="lazyload placeholder" data-srcset="https://gitee.com/yangyang-linux/yangyang-linux-io/raw/master/img/image-20210829182944924.png" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="image-20210829182944924"></p>
<p><a target="_blank" rel="noopener" href="https://github.com/c0ny1/xxe-lab">demo，国外xxe-lab</a></p>
<div class="video"><video controls preload><source src='https://static-v.zhishibox.net/20210115/107624241.mp4' type='video/mp4'>Your browser does not support the video tag.</video></div>


      </div>
      <div class="post-tags-categories">
        
        <div class="tags">
          
            <a href="/tags/CTF/" class="">
              CTF
            </a>
          
        </div>
        
      </div>
      
        <div class="copyright">
  <ul class="post-copyright">
    <li class="post-copyright-author">
    <strong>作者:  </strong>阳阳</a>
    </li>
    <li class="post-copyright-link">
    <strong>文章链接:  </strong>
    <a href="/2021/06/23/2021-06-23-ctf-zhi-web-ji-chu-zhi-shi/" target="_blank" title="ctf之web基础知识">https://yangyang-linux.gitee.io/2021/06/23/2021-06-23-ctf-zhi-web-ji-chu-zhi-shi/</a>
    </li>
    <li class="post-copyright-license">
      <strong>版权声明:   </strong>
      本网站所有文章除特别声明外,均采用 <a rel="license" href="https://creativecommons.org/licenses/by-nc-nd/4.0/" target="_blank" title="Attribution-NonCommercial-NoDerivatives 4.0 International (CC BY-NC-ND 4.0)">CC BY-NC-ND 4.0</a>
      许可协议。转载请注明出处!
    </li>
  </ul>
<div>
      
    </article>
    <!-- 上一篇文章和下一篇文章 -->
    
      <!-- 文章详情页的上一页和下一页 -->
<div class="post-nav">



  
  <div class="post-nav-prev post-nav-item">
    <div class="post-nav-img" style="background-size: cover; 
      background-position: center center;">
      <img class="lazyload lazyload placeholder" src="/medias/4.jpg" class="lazyload placeholder" data-srcset="/medias/4.jpg" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="">
    </div>
    <a href="/2021/06/27/2020-12-17-sql-zhu-ru-lou-dong-xiang-jie/" class="post-nav-link">
      <div class="title">
        <i class="fas fa-angle-left"></i> 上一篇:
        <div class="title-text">SQL注入漏洞详解</div>
      </div>
      
      <!-- <div class="content">
        SQL注入
原理：就是通过把SQL命令插入到Web表单递交或输入域名或页面请求的查询字符串，最终达到欺骗服务器执行恶意的
      </div> -->
    </a>
  </div>



  
  <div class="post-nav-next post-nav-item">
    <div class="post-nav-img" style="background-size: cover; 
      background-position: center center;">
      <img class="lazyload lazyload placeholder" src="/medias/2.jpg" class="lazyload placeholder" data-srcset="/medias/2.jpg" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" src="" alt="">
    </div>
    <a href="/2021/06/23/2021-06-23-ctf-zhi-wo-jian/" class="post-nav-link">
      <div class="title">
        下一篇: <i class="fas fa-angle-right"></i>
        <div class="title-text">ctf之我见</div>
      </div>
      <!-- <div class="content">
        ctf环境搭建
Google CTF: https://github.com/google/google-ctf

Hi
      </div> -->
    </a>
  </div>

</div>

    
    

    <!-- 打赏 -->
    
      <div id="appDonate" class="post-donate">
  <div id="donate_board" class="donate_bar center" ref="donate">
    <a id="btn_donate" class="btn_donate" href="javascript:;" title="打赏" @click="showDialogDrawer()"></a>
  </div>
  <transition name="fade">
    <div 
      class="donate-box-mask"
      v-cloak 
      v-show="visible"
      @click="cancelDialogDrawer()"
    >
    </div>
  </transition>
  <transition name="bounce">
    <div class="donate-box" v-cloak v-show="visible">
      <div class="donate-box_close">
        <i class="fas fa-times" aria-hidden="true" @click="cancelDialogDrawer" pointer></i>
      </div>
      <div class="donate-box_title">
        <h4>
          你的赏识是我前进的动力
        </h4>
      </div>
      <div class="donate-box_tab">
        <div class="Alipay" pointer :class="{'active': tabActive === 'Alipay'}" @click="changeTabActive('Alipay')">
          支付宝
        </div>
        <div class="WeChatpay" pointer :class="{'active': tabActive === 'WeChatpay'}" @click="changeTabActive('WeChatpay')">
          微信
        </div>
      </div>
      <div class="donate-box_img">
        <div class="AlipayImg" v-show="tabActive === 'Alipay'">
          <img src="/medias/zfb.jpg" class="lazyload placeholder" data-srcset="/medias/zfb.jpg" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="支付宝打赏" />
        </div> 
        <div class="WeChatpayImg" v-show="tabActive === 'WeChatpay'">
          <img src="/medias/wx.jpg" class="lazyload placeholder" data-srcset="/medias/wx.jpg" srcset="https://img10.360buyimg.com/ddimg/jfs/t1/157667/29/9156/134350/603c6445Ebbc9cabe/41219c5d36d45072.gif" alt="微信打赏" />
        </div>
      </div>
    </div>
  </transition>
</div>

<script>
  var body = document.body || document.documentElement || window;
  var vm = new Vue({
    el: '#appDonate',
    data: {
      visible: false,
      tabActive: 'Alipay',
      top: 0,
    },
    computed: {
    },
    mounted() {
    },
    methods: {
      showDialogDrawer() {
        this.visible = true;
        // 防止页面滚动，只能让弹框滚动
        // function getScroll() {
        //   return {
        //     left: window.pageXOffset || document.documentElement.scrollLeft || document.body.scrollLeft || 0,
        //     top: window.pageYOffset || document.documentElement.scrollTop || document.body.scrollTop || 0
        //   };
        // }
        this.top = $(document).scrollTop() // or getScroll().top
        // console.log('aa', $('.main-content'));
        body.style.cssText = 'overflow: hidden;';
      },
      cancelDialogDrawer() {
        this.visible = false;
        body.removeAttribute('style');
        $(document).scrollTop(this.top)
      },
      changeTabActive(name) {
        this.tabActive = name;
      }
    },
    created() {}
  })
</script>
    

    <!-- 分享 -->
    
      <!-- https://github.com/overtrue/share.js -->
<!-- 文章详情页的分享 -->
<div class="social-share" data-sites="twitter,facebook,google,qq,qzone,wechat,weibo,douban,linkedin" data-wechat-qrcode-helper="<p>微信扫一扫即可分享！</p>"></div>

<script src="/js/shareJs/social-share.min.js"></script>
</script>

<style>
  .social-share {
    margin: 20px 0;
  }
</style>


    
    
    <!-- 评论 -->
    <!-- 评论 -->

  <div id="myComment">
    
      
<section id="comments" style="padding: 1em; margin: 15px auto;"
	class="animated bounceInUp">
	<div id="vcomment" class="comment"></div>
</section>
<style>
	#comments {
		background: rgba(255,255,255,0.9);
	}
	#veditor {
		background-image: url('https://img.zcool.cn/community/01a253594c71cfa8012193a329a77f.gif');
		background-size: contain;
		background-repeat: no-repeat;
		background-position: right;
		background-color: rgba(255, 255, 255, 0);
		resize: vertical;
	}
	#veditor:focus{
		background-position-y: 200px;
		transition: all 0.2s ease-in-out 0s;
	}
	#vcomment .vcards .vcard .vh .vhead .vtag.vvisitor {
		background-color: #42b983;
	}
	.v[data-class=v] .vbtn:active, .v[data-class=v] .vbtn:hover {
		color: #42b983;
		border-color: #42b983;
	}
	#vcomment .vcards .vcard .vhead .vsys i {
		display: none;
	}
	/* 底部valine链接 */
	#vcomment .vpower {
		display: none;
	}
	
	/* 底下注释是修改 名称和邮箱和网址输入框的样式 */
	/* #vcomment .vheader {
		display: flex;
		justify-content: space-around;
	}
	
	#vcomment .vheader .vnick {
		width: 31%;
		border: 2px solid #dedede;
		padding-left: 10px;
		padding-right: 10px;
		border-radius: 5px
	}

	#vcomment .vheader .vmail {
		width: 31%;
		border: 2px solid #dedede;
		padding-left: 10px;
		padding-right: 10px;
		border-radius: 5px
	}

	#vcomment .vheader .vlink {
		width: 31%;
		border: 2px solid #dedede;
		padding-left: 10px;
		padding-right: 10px;
		border-radius: 5px
	} */

	img.vimg {
		transition: all 1s;
		/* 头像旋转时间为 1s */
	}

	img.vimg:hover {
		transform: rotate(360deg);
		-webkit-transform: rotate(360deg);
		-moz-transform: rotate(360deg);
		-o-transform: rotate(360deg);
		-ms-transform: rotate(360deg);
	}

	#vcomment .vcards .vcard {
		padding: 15px 20px 0 20px;
		border-radius: 10px;
		margin-bottom: 15px;
		box-shadow: 0 0 4px 1px rgba(0, 0, 0, .12);
		transition: all .3s
	}

	#vcomment .vcards .vcard:hover {
		box-shadow: 0 0 8px 3px rgba(0, 0, 0, .12)
	}

	#vcomment .vcards .vcard .vh .vcard {
		border: none;
		box-shadow: none;
	}
</style>
    
  </div>

<!-- comment script in themes\hexo-theme-bamboo\layout\_partial\scripts\index.ejs -->


  </div>

  <!-- 目录 -->
  <!-- 文章详情页右侧目录 -->

  <div class="toc-aside">
    <div class="toc-main">
      <div class="toc-aside-title">
        <i class="fas fa-list-ul" aria-hidden="true"></i><span>本文目录</span>
        
          <div class="toc-open-close">本文目录</div>
        
      </div>
      <div class="toc-content">
        <div class="toc"></div>
      </div>
    </div>
  </div>

  <!-- 手机端目录按钮 -->
  <div id="toc-mobile-btn">
    <i class="fas fa-list-ul" aria-hidden="true"></i>
  </div>


<script>
  function closeToc(init) {
    $(".toc-aside").css({'width': 0, 'padding': 0, 'transition': init ?  'noe' : 'width 0.3s' });
    $(".toc-content").css({'width': 0});
    $(".toc-aside-title span, .toc-aside-title i").css({'display': 'none'});
    $(".main-content").css({'width': '75%', 'margin': '10px auto'});
  };
  function openToc() {
    $(".main-content").css({'width': '65%', 'margin-right': '10px', 'margin-left': 'calc(35% - 350px)'});
    $(".toc-aside").css({'width': '300px', 'padding': '0 10px', 'transition': 'width 0.3s'});
    $(".toc-content").css({'width': '300px'});
    $(".toc-aside-title span, .toc-aside-title i").css({'display': 'inline-block'});
  }
  function openBtnClickFn () {
    let openOrCloseBtn = $('.toc-aside .toc-aside-title .toc-open-close');
    let open = eval('' || 'false');
    openOrCloseBtn.click(function() {
      if (open) {
        closeToc();
        open = false;
      } else {
        openToc();
        open = true;
      }
    });
  };
  openBtnClickFn();
  initCloseTocWidth(true);

  function initCloseTocWidth(init) {
    if (window.innerWidth >= 992) {
      let isClose = true;
      isClose && closeToc(init)
    }
  }

  document.addEventListener('pjax:complete', function () {
    $(".toc-aside").css({'transition': 'no'});
  })
  document.addEventListener('pjax:complete', function () {
    openBtnClickFn();
  })
  
</script>

  <!-- 图片放大 Wrap images with fancybox support -->
  <script src="/js/wrapImage.js"></script>
</div>

<!-- 文章详情页背景图 -->
<div id="appBgSwiper" style="position: fixed;left: 0;top: 0;width: 100%;height: 100%;z-index: -2;"
	:style="{'background-color': bgColor ? bgColor : 'transparent'}">
	<transition-group tag="ul" :name="names">
		<li v-for='(image,index) in img' :key='index' v-show="index === mark" class="bg-swiper-box">
			<img :src="image" class="bg-swiper-img no-lazy">
		</li>
	</transition-group>
</div>
<script>
	var vm = new Vue({
		el: '#appBgSwiper',
		data: {
			names: '' || 'fade' || 'fade', // translate-fade fade
			mark: 0,
			img: [],
			bgColor: '',
			time: null
		},
		methods: {   //添加方法
			change(i, m) {
				if (i > m) {
					// this.names = 'fade';
				} else if (i < m) {
					// this.names = 'fade';
				} else {
					return;
				}
				this.mark = i;
			},
			prev() {
				// this.names = 'fade';
				this.mark--;
				if (this.mark === -1) {
					this.mark = 3;
					return
				}
			},
			next() {
				// this.names = 'fade';
				this.mark++;
				if (this.mark === this.img.length) {
					this.mark = 0;
					return
				}
			},
			autoPlay() {
				// this.names = 'fade';
				this.mark++;
				if (this.mark === this.img.length) {
					this.mark = 0;
					return
				}
			},
			play() {
				let bgImgDelay = '' || '180000'
				let delay = parseInt(bgImgDelay) || 180000;
				this.time = setInterval(this.autoPlay, delay);
			},
			enter() {
				clearInterval(this.time);
			},
			leave() {
				this.play();
			}
		},
		created() {
			this.play()
		},
		beforeDestroy() {
			clearInterval(this.time);
		},
		mounted() {
			let prop = '' || 'https://pic4.zhimg.com/80/v2-5030587bac1b856d09e0a119ff6d7c04_1440w.jpg,https://api.btstu.cn/sjbz/api.php';
			let isImg = prop.includes('.bmp') || prop.includes('.jpg') || prop.includes('.png') || prop.includes('.tif') || prop.includes('.gif') || prop.includes('.pcx') || prop.includes('.tga') || prop.includes('.exif') || prop.includes('.fpx') || prop.includes('.psd') || prop.includes('.cdr') || prop.includes('.pcd') || prop.includes('.dxf') || prop.includes('.ufo') || prop.includes('.eps') || prop.includes('.ai') || prop.includes('.raw') || prop.includes('.WMF') || prop.includes('.webp') || prop.includes('.jpeg') || prop.includes('http://') || prop.includes('https://')
			if (isImg) {
				let img = prop.split(',');
				let configRoot = '/'
				let arrImg = [];
				img.forEach(el => {
					var Expression = /http(s)?:\/\/([\w-]+\.)+[\w-]+(\/[\w- .\/?%&=]*)?/;
					var objExp = new RegExp(Expression);

					if (objExp.test(el)) {
						// http or https
						arrImg.push(el);
					} else {
						// 非http or https开头
						// 本地文件
						let firstStr = el.charAt(0);
						if (firstStr == '/') {
							el = el.substr(1); // 删除第一个字符 '/',因为 configRoot最后一个字符为 /
						}
						el = configRoot + el;
						arrImg.push(el);
					}
				})
				this.img = arrImg;
			} else {
				this.bgColor = prop;
			}
		}
	})
</script>

<style>
	.bg-swiper-box {
		position: absolute;
		display: block;
		width: 100%;
		height: 100%;
	}

	.bg-swiper-img {
		object-fit: cover;
		width: 100%;
		height: 100%;
	}
</style>




  <script>
  function loadMermaid() {
    if (document.getElementsByClassName('mermaid').length) {
      if (window.mermaidJsLoad) mermaid.init()
      else {
        loadScript('https://cdnjs.cloudflare.com/ajax/libs/mermaid/8.6.3/mermaid.min.js').then(() => {
          window.mermaidJsLoad = true
          mermaid.initialize({
            theme: 'default',
          })
          if ('true') {
            mermaid.init();
          }
        })
      }
    }
  };
  document.addEventListener("DOMContentLoaded", function () {
    loadMermaid();
  })

  document.addEventListener('pjax:complete', function () {
    loadMermaid();
  })
  
</script>


      </main>
    </div>

    <!-- 页脚 -->
    
  
  <!-- 底部鱼儿跳动效果，依赖于jquery-->
<div id="j-fish-skip" style=" position: relative;height: 153px;width: auto;"></div>
<script>
  var RENDERER = {
    POINT_INTERVAL: 5,
    FISH_COUNT: 3,
    MAX_INTERVAL_COUNT: 50,
    INIT_HEIGHT_RATE: .5,
    THRESHOLD: 50,
    FISH_COLOR: '',
    init: function () {
      this.setFishColor(); this.setParameters(), this.reconstructMethods(), this.setup(), this.bindEvent(), this.render()
    },
    setFishColor: function () {
      let isDark = JSON.parse(localStorage.getItem('dark')) || JSON.parse('false');
      if (isDark) {
        this.FISH_COLOR = '#222'; // 暗黑色，有时间把这整成一个变量
      } else {
        this.FISH_COLOR = '' || '#42b983';
      }
    },
    setParameters: function () {
      this.$window = $(window), this.$container = $("#j-fish-skip"), this.$canvas = $("<canvas />"), this.context = this.$canvas.appendTo(this.$container).get(0).getContext("2d"), this.points = [], this.fishes = [], this.watchIds = []
    },
    createSurfacePoints: function () {
      var t = Math.round(this.width / this.POINT_INTERVAL);
      this.pointInterval = this.width / (t - 1), this.points.push(new SURFACE_POINT(this, 0));
      for (var i = 1; i < t; i++) {
        var e = new SURFACE_POINT(this, i * this.pointInterval),
          h = this.points[i - 1];
        e.setPreviousPoint(h), h.setNextPoint(e), this.points.push(e)
      }
    },
    reconstructMethods: function () {
      this.watchWindowSize = this.watchWindowSize.bind(this), this.jdugeToStopResize = this.jdugeToStopResize.bind(this), this.startEpicenter = this.startEpicenter.bind(this), this.moveEpicenter = this.moveEpicenter.bind(this), this.reverseVertical = this.reverseVertical.bind(this), this.render = this.render.bind(this)
    },
    setup: function () {
      this.points.length = 0, this.fishes.length = 0, this.watchIds.length = 0, this.intervalCount = this.MAX_INTERVAL_COUNT, this.width = this.$container.width(), this.height = this.$container.height(), this.fishCount = this.FISH_COUNT * this.width / 500 * this.height / 500, this.$canvas.attr({
        width: this.width,
        height: this.height
      }), this.reverse = !1, this.fishes.push(new FISH(this)), this.createSurfacePoints()
    },
    watchWindowSize: function () {
      this.clearTimer(), this.tmpWidth = this.$window.width(), this.tmpHeight = this.$window.height(), this.watchIds.push(setTimeout(this.jdugeToStopResize, this.WATCH_INTERVAL))
    },
    clearTimer: function () {
      for (; this.watchIds.length > 0;) clearTimeout(this.watchIds.pop())
    },
    jdugeToStopResize: function () {
      var t = this.$window.width(),
        i = this.$window.height(),
        e = t == this.tmpWidth && i == this.tmpHeight;
      this.tmpWidth = t, this.tmpHeight = i, e && this.setup()
    },
    bindEvent: function () {
      this.$window.on("resize", this.watchWindowSize), this.$container.on("mouseenter", this.startEpicenter), this.$container.on("mousemove", this.moveEpicenter)
    },
    getAxis: function (t) {
      var i = this.$container.offset();
      return {
        x: t.clientX - i.left + this.$window.scrollLeft(),
        y: t.clientY - i.top + this.$window.scrollTop()
      }
    },
    startEpicenter: function (t) {
      this.axis = this.getAxis(t)
    },
    moveEpicenter: function (t) {
      var i = this.getAxis(t);
      this.axis || (this.axis = i), this.generateEpicenter(i.x, i.y, i.y - this.axis.y), this.axis = i
    },
    generateEpicenter: function (t, i, e) {
      if (!(i < this.height / 2 - this.THRESHOLD || i > this.height / 2 + this.THRESHOLD)) {
        var h = Math.round(t / this.pointInterval);
        h < 0 || h >= this.points.length || this.points[h].interfere(i, e)
      }
    },
    reverseVertical: function () {
      this.reverse = !this.reverse;
      for (var t = 0, i = this.fishes.length; t < i; t++) this.fishes[t].reverseVertical()
    },
    controlStatus: function () {
      for (var t = 0, i = this.points.length; t < i; t++) this.points[t].updateSelf();
      for (t = 0, i = this.points.length; t < i; t++) this.points[t].updateNeighbors();
      this.fishes.length < this.fishCount && 0 == --this.intervalCount && (this.intervalCount = this.MAX_INTERVAL_COUNT, this.fishes.push(new FISH(this)))
    },
    render: function () {
      requestAnimationFrame(this.render), this.controlStatus(), this.context.clearRect(0, 0, this.width, this.height), this.context.fillStyle = this.FISH_COLOR;
      for (var t = 0, i = this.fishes.length; t < i; t++) this.fishes[t].render(this.context);
      this.context.save(), this.context.globalCompositeOperation = "xor", this.context.beginPath(), this.context.moveTo(0, this.reverse ? 0 : this.height);
      for (t = 0, i = this.points.length; t < i; t++) this.points[t].render(this.context);
      this.context.lineTo(this.width, this.reverse ? 0 : this.height), this.context.closePath(), this.context.fill(), this.context.restore()
    }
  },
  SURFACE_POINT = function (t, i) {
    this.renderer = t, this.x = i, this.init()
  };
  SURFACE_POINT.prototype = {
    SPRING_CONSTANT: .03,
    SPRING_FRICTION: .9,
    WAVE_SPREAD: .3,
    ACCELARATION_RATE: .01,
    init: function () {
      this.initHeight = this.renderer.height * this.renderer.INIT_HEIGHT_RATE, this.height = this.initHeight, this.fy = 0, this.force = {
        previous: 0,
        next: 0
      }
    },
    setPreviousPoint: function (t) {
      this.previous = t
    },
    setNextPoint: function (t) {
      this.next = t
    },
    interfere: function (t, i) {
      this.fy = this.renderer.height * this.ACCELARATION_RATE * (this.renderer.height - this.height - t >= 0 ? -1 : 1) * Math.abs(i)
    },
    updateSelf: function () {
      this.fy += this.SPRING_CONSTANT * (this.initHeight - this.height), this.fy *= this.SPRING_FRICTION, this.height += this.fy
    },
    updateNeighbors: function () {
      this.previous && (this.force.previous = this.WAVE_SPREAD * (this.height - this.previous.height)), this.next && (this.force.next = this.WAVE_SPREAD * (this.height - this.next.height))
    },
    render: function (t) {
      this.previous && (this.previous.height += this.force.previous, this.previous.fy += this.force.previous), this.next && (this.next.height += this.force.next, this.next.fy += this.force.next), t.lineTo(this.x, this.renderer.height - this.height)
    }
  };
  var FISH = function (t) {
    this.renderer = t, this.init()
  };
  FISH.prototype = {
    GRAVITY: .4,
    init: function () {
      this.direction = Math.random() < .5, this.x = this.direction ? this.renderer.width + this.renderer.THRESHOLD : -this.renderer.THRESHOLD, this.previousY = this.y, this.vx = this.getRandomValue(4, 10) * (this.direction ? -1 : 1), this.renderer.reverse ? (this.y = this.getRandomValue(1 * this.renderer.height / 10, 4 * this.renderer.height / 10), this.vy = this.getRandomValue(2, 5), this.ay = this.getRandomValue(.05, .2)) : (this.y = this.getRandomValue(6 * this.renderer.height / 10, 9 * this.renderer.height / 10), this.vy = this.getRandomValue(-5, -2), this.ay = this.getRandomValue(-.2, -.05)), this.isOut = !1, this.theta = 0, this.phi = 0
    },
    getRandomValue: function (t, i) {
      return t + (i - t) * Math.random()
    },
    reverseVertical: function () {
      this.isOut = !this.isOut, this.ay *= -1
    },
    controlStatus: function (t) {
      this.previousY = this.y, this.x += this.vx, this.y += this.vy, this.vy += this.ay, this.renderer.reverse ? this.y > this.renderer.height * this.renderer.INIT_HEIGHT_RATE ? (this.vy -= this.GRAVITY, this.isOut = !0) : (this.isOut && (this.ay = this.getRandomValue(.05, .2)), this.isOut = !1) : this.y < this.renderer.height * this.renderer.INIT_HEIGHT_RATE ? (this.vy += this.GRAVITY, this.isOut = !0) : (this.isOut && (this.ay = this.getRandomValue(-.2, -.05)), this.isOut = !1), this.isOut || (this.theta += Math.PI / 20, this.theta %= 2 * Math.PI, this.phi += Math.PI / 30, this.phi %= 2 * Math.PI), this.renderer.generateEpicenter(this.x + (this.direction ? -1 : 1) * this.renderer.THRESHOLD, this.y, this.y - this.previousY), (this.vx > 0 && this.x > this.renderer.width + this.renderer.THRESHOLD || this.vx < 0 && this.x < -this.renderer.THRESHOLD) && this.init()
    },
    render: function (t) {
      t.save(), t.translate(this.x, this.y), t.rotate(Math.PI + Math.atan2(this.vy, this.vx)), t.scale(1, this.direction ? 1 : -1), t.beginPath(), t.moveTo(-30, 0), t.bezierCurveTo(-20, 15, 15, 10, 40, 0), t.bezierCurveTo(15, -10, -20, -15, -30, 0), t.fill(), t.save(), t.translate(40, 0), t.scale(.9 + .2 * Math.sin(this.theta), 1), t.beginPath(), t.moveTo(0, 0), t.quadraticCurveTo(5, 10, 20, 8), t.quadraticCurveTo(12, 5, 10, 0), t.quadraticCurveTo(12, -5, 20, -8), t.quadraticCurveTo(5, -10, 0, 0), t.fill(), t.restore(), t.save(), t.translate(-3, 0), t.rotate((Math.PI / 3 + Math.PI / 10 * Math.sin(this.phi)) * (this.renderer.reverse ? -1 : 1)), t.beginPath(), this.renderer.reverse ? (t.moveTo(5, 0), t.bezierCurveTo(10, 10, 10, 30, 0, 40), t.bezierCurveTo(-12, 25, -8, 10, 0, 0)) : (t.moveTo(-5, 0), t.bezierCurveTo(-10, -10, -10, -30, 0, -40), t.bezierCurveTo(12, -25, 8, -10, 0, 0)), t.closePath(), t.fill(), t.restore(), t.restore(), this.controlStatus(t)
    }
  }, $(function () {
    RENDERER.init()
    $('.dark').click(function () {
      setTimeout(() => {
        RENDERER.setFishColor();
        RENDERER.context.fill();
      });
    })
  });
</script>
  <div class="footer bg-color">
    <div class="footer-main">
      
        
          <div class="link">
            
              
                <a href="mailto:2985409357@qq.com" class="social">
                  
                    <i class="fa fa-envelope" aria-hidden="true"></i>
                  
                </a>
              
            
              
                <a target="_blank" rel="noopener" href="https://github.com/yangyang-linux" class="social">
                  
                    <i class="fab fa-github" aria-hidden="true"></i>
                  
                </a>
              
            
              
                <a href="tencent://AddContact/?fromId=50&amp;fromSubId=1&amp;subcmd=all&amp;uin=2985409357" class="social">
                  
                    <i class="fab fa-qq" aria-hidden="true"></i>
                  
                </a>
              
            
          </div>
        
      
        
          <div class="footer-copyright">
            <p>Copyright © 2019 - <span id="display_copyright_time"></span> <a target="_blank" rel="noopener" href="https://gitee.com/yangyang-linux">yangyang-linux</a> | Powered by <a target="_blank" rel="noopener" href="https://hexo.io/zh-cn/docs/">Hexo</a> | Theme <a target="_blank" rel="noopener" href="https://github.com/yuang01/theme">Bamboo</a></p>

          </div>
        
      
        
          
            <!-- 不蒜子统计 -->
            <!-- 不蒜子统计 -->
<span id="busuanzi_container_site_pv">
      <i class="fas fa-eye" aria-hidden="true"></i>本站总访问量：<span id="busuanzi_value_site_pv"></span> 次
</span>
<span class="post-meta-divider">|</span>
<span id="busuanzi_container_site_uv" style='display:none'>
      <i class="fas fa-users" aria-hidden="true"></i>本站访客数：<span id="busuanzi_value_site_uv"></span> 人
</span>

          
        
      
        
          <div class="footer-custom">
            
              <div><p><span>本博客已萌萌哒地运行</span><span id="display_live_time"></span></p>
</div>
            
          </div>
        
      
		</br>
		</br>
		</br>
    </div>
  </div>



    <!-- 渲染暗黑按钮 -->
    
      <div class="dark">
  <div class="dark-content">
    <i class="fas fa-moon" aria-hidden="true"></i>
    <!-- <span>关灯</span> -->
  </div>
  
</div>

<script>
  $(function() {
    let isDark = JSON.parse(localStorage.getItem('dark'))  || JSON.parse('false');
    if (isDark) {
      $(".dark-content").replaceWith(
          `
          <div class='dark-content'>
            <i class="fas fa-lightbulb" aria-hidden="true"></i>
          </div>
          `
        );
    }
    $('.dark').click(function() {
      if ($(document.body).is('.darkModel')) {
        $(document.body).removeClass('darkModel');
        localStorage.setItem('dark', false);
        $(".dark-content").replaceWith(
          `
          <div class='dark-content'>
            <i class="fas fa-moon" aria-hidden="true"></i>
          </div>
          `
        );
      } else {
        $(document.body).addClass('darkModel');
        localStorage.setItem('dark', true);
        $(".dark-content").replaceWith(
          `
          <div class='dark-content'>
            <i class="fas fa-lightbulb" aria-hidden="true"></i>
          </div>
          `
        );
      }
    })
  })
</script>
    
    <!-- 渲染回到顶部按钮 -->
    
      <div class="goTop top-btn-color" pointer>
  <i class="fas fa-arrow-up" aria-hidden="true"></i>
</div>
<script src="/js/goTop.js"></script>

    
    <!-- 渲染左下角音乐播放器 -->
    
      <link rel="stylesheet" href="/js/aplayer/APlayer@1.10.1.min.css">
<style>
.aplayer .aplayer-lrc p {
  
  font-size: 12px;
  font-weight: 700;
  line-height: 16px !important;
}

.aplayer .aplayer-lrc p.aplayer-lrc-current {
  
  font-size: 15px;
  color: #C90041;
}


.aplayer.aplayer-fixed.aplayer-narrow .aplayer-body {
  left: -66px !important;
}

.aplayer.aplayer-fixed.aplayer-narrow .aplayer-body:hover {
  left: 0px !important;
}


</style>
<meting-js  
  class=""
  server="netease"
  type="playlist"
  id="5300120281"
  fixed='true'
  autoplay='true'
  theme='#C90041'
  loop='all'
  order='random'
  preload='auto'
  volume='0.4'
  list-folded='true'
>
</meting-js>

<!-- <style>
  #aplayer {
    position: fixed;
    left: 0;
    bottom: 300px;
  }
</style> -->
<script src="https://unpkg.com/aplayer@1.10.1/dist/APlayer.min.js"></script>
<script src="https://unpkg.com/meting@2/dist/Meting.min.js"></script>
    

    <!-- 图片放大 -->
    
      <script src="/js/fancybox/jquery.fancybox.min.js"></script>
    

    <!-- 百度解析 -->
    <!-- Baidu Analytics -->

    <!-- Baidu Push -->

<script>
    (function () {
        var bp = document.createElement('script');
        var curProtocol = window.location.protocol.split(':')[0];
        if (curProtocol === 'https') {
            bp.src = 'https://zz.bdstatic.com/linksubmit/push.js';
        } else {
            bp.src = 'http://push.zhanzhang.baidu.com/push.js';
        }
        var s = document.getElementsByTagName("script")[0];
        s.parentNode.insertBefore(bp, s);
    })();
</script>

    
    <!-- 背景彩带 -->
    
      <script type="text/javascript" size="100" alpha='0.4' zIndex="-1" src="/js/ribbon.min.js"></script>
    

    <script src="/js/utils/index.js"></script>
    <script src="/js/app.js"></script>
    
    <!-- 文章目录所需js -->
<link href="/js/tocbot/tocbot.css" rel="stylesheet">
<script src="/js/tocbot/tocbot.min.js"></script>

<script>
  var headerEl = 'h1, h2, h3, h4, h5, h6',  //headers 
    content = '.post-detail',//文章容器
    idArr = {};  //标题数组以确定是否增加索引id
  //add #id
  var option = {
    // Where to render the table of contents.
    tocSelector: '.toc',
    // Where to grab the headings to build the table of contents.
    contentSelector: content,
    // Which headings to grab inside of the contentSelector element.
    headingSelector: headerEl,
    scrollSmooth: true,
    scrollSmoothOffset: -80,
    headingsOffset: -($(window).height() * 0.4 - 45),
    positionFixedSelector: '.toc-main',
    positionFixedClass: 'is-position-fixed',
    fixedSidebarOffset: 'auto',
    activeLinkClass: 'is-active-link',
    // onClick: function (e) {},
  }
  if ($('.toc').length > 0) {

    $(content).children(headerEl).each(function () {
      //去除空格以及多余标点
      var headerId = $(this).text().replace(/[\s|\~|`|\!|\@|\#|\$|\%|\^|\&|\*|\(|\)|\_|\+|\=|\||\|\[|\]|\{|\}|\;|\:|\"|\'|\,|\<|\.|\>|\/|\?|\：|\，|\。]/g, '');

      headerId = headerId.toLowerCase();
      if (idArr[headerId]) {
        //id已经存在
        $(this).attr('id', headerId + '-' + idArr[headerId]);
        idArr[headerId]++;
      }
      else {
        //id未存在
        idArr[headerId] = 1;
        $(this).attr('id', headerId);
      }
    });

    document.addEventListener("DOMContentLoaded", function () {
      tocbot.init(option);
      mobileTocClick();
    });

  }

  window.tocScrollFn = function () {
    return bamboo.throttle(function () {
      findHeadPosition();
    }, 100)()
  }
  window.addEventListener('scroll', tocScrollFn);

  const findHeadPosition = function (top) {
    if ($('.toc-list').length <= 0) {
      return false;
    }
    setTimeout(() => {  // or DOMContentLoaded 
      autoScrollToc();
    }, 0);
  }

  const autoScrollToc = function () {
    const $activeItem = document.querySelector('.is-active-link');
    const $cardToc = document.querySelector('.toc-content');
    const activePosition = $activeItem.getBoundingClientRect().top
    const sidebarScrollTop = $cardToc.scrollTop
    if (activePosition > (document.documentElement.clientHeight - 100)) {
      $cardToc.scrollTop = sidebarScrollTop + 150
    }
    if (activePosition < 100) {
      $cardToc.scrollTop = sidebarScrollTop - 150
    }
  }

  document.addEventListener('pjax:send', function () {
    if ($('.toc').length) {
      tocbot.destroy();
    }
  });

  document.addEventListener('pjax:complete', function () {
    if ($('.toc').length) {
      tocbot.init(option);
      mobileTocClick();
    }
  });
  
  // 手机端toc按钮点击出现目录
  const mobileTocClick = function () {
    const $cardTocLayout = document.getElementsByClassName('toc-aside')[0];
    const $cardToc = $cardTocLayout.getElementsByClassName('toc-content')[0];
    let right = '45px';
    if (window.innerWidth >= 551 && window.innerWidth <= 992) {
      right = '100px'
    }
    const mobileToc = {
      open: () => {
        $cardTocLayout.style.cssText = 'animation: toc-open .3s; opacity: 1; right: ' + right
      },

      close: () => {
        $cardTocLayout.style.animation = 'toc-close .2s'
        setTimeout(() => {
          $cardTocLayout.style.cssText = "opacity:''; animation: ''; right: ''"
        }, 100)
      }
    }
    document.getElementById('toc-mobile-btn').addEventListener('click', () => {
      if (window.getComputedStyle($cardTocLayout).getPropertyValue('opacity') === '0') mobileToc.open()
      else mobileToc.close()
    })

    $cardToc.addEventListener('click', (e) => {
      if (window.innerWidth < 992) { // 小于992px的时候
        mobileToc.close()
      }
    })
  }
</script>

<style>
  .is-position-fixed {
    position: sticky !important;
    top: 74px;
  }

  .toc-main ul {
    counter-reset: show-list;
  }

  .toc-main ul li::before {
    content: counter(item)".";
    display: block;
    position: absolute;
    left: 12px;
    top: 0;
  }
</style> 

<!-- 设置导航背景 -->
<script>
  let setHeaderClass = () => {
    const headerMenuTransparent = true;
    if (!headerMenuTransparent) { return; }
    const nav = $('#navHeader');
    const navTop = nav.outerHeight();
    const winTop = $(window).scrollTop();
    if(winTop > navTop) {
      nav.addClass('header-bg-color');
    }
    else {
      nav.removeClass('header-bg-color');
    }
  };

  let scrollCollect = () => {
    return bamboo.throttle(function (e) {
      setHeaderClass();
    }, 200)()
  }

  let initHeaderBg = () => {
    setHeaderClass();
  }

  setHeaderClass();
  window.addEventListener('scroll', scrollCollect);

  document.addEventListener('pjax:send', function () {
    window.removeEventListener('scroll', scrollCollect)
  })
  document.addEventListener('pjax:complete', function () {
    window.addEventListener('scroll', scrollCollect);
    setHeaderClass();
  })
</script> 

<!-- 渲染issues标签里的内容 -->
<script>
  function loadIssuesJS() {
    if ($(".post-detail").find(".issues-api").length == 0) {
      return;
    } 
    loadScript('/js/issues/index.js');
  };
  $(function () {
    loadIssuesJS();
  });
  document.addEventListener('pjax:complete', function () {
    if (typeof IssuesAPI == "undefined") {
      loadIssuesJS();
    }
  })
</script>

<!-- 输入框打字特效 -->
<!-- 输入框打字特效 -->

  <script src="/js/activate-power-mode.js"></script>
  <script>
    POWERMODE.colorful = true;  // 打开随机颜色特效
    POWERMODE.shake = false;    // 关闭输入框抖动
    document.body.addEventListener('input', POWERMODE);//监听打字事件
  </script>


<!-- markdown代码一键复制功能 -->

  <link rel="stylesheet" href="https://unpkg.com/v-plugs-ayu/lib/ayu.css">
  <script src="https://unpkg.com/v-plugs-ayu/lib/ayu.umd.min.js"></script>
  <script src="/js/clipboard/clipboard.min.js"></script>
  <div id="appCopy">
  </div>
  <script data-pjax>
    var vm = new Vue({
      el: '#appCopy',
      data: {
      },
      computed: {
      },
      mounted() {
        const that = this;
        var copy = '复制';
        /* code */
        var initCopyCode = function () {
          var copyHtml = '';
          copyHtml += '<button class="btn-copy" data-clipboard-snippet="" style="position:absolute;top:0;right:0;z-index:1;">';
          copyHtml += '<i class="fas fa-copy"></i><span>' + copy + '</span>';
          copyHtml += '</button>';
          $(".post-detail pre").not('.gutter pre').wrap("<div class='codeBox' style='position:relative;width:100%;'></div>")
          $(".post-detail pre").not('.gutter pre').before(copyHtml);
          new ClipboardJS('.btn-copy', {
            target: function (trigger) {
              return trigger.nextElementSibling;
            }
          });
        }
        initCopyCode();
        $('.btn-copy').unbind('click').bind('click', function () {
          doSomething();
        })
        $(document).unbind('keypress').bind('keypress', function (e) {
          if (e.ctrlKey && e.keyCode == 67) {
            doSomething();
          }
        })

        function doSomething() {
          that.$notify({
            title: "成功",
            content: "代码已复制，请遵守相关授权协议。",
            type: 'success'
          })
        }
      },
      methods: {
      },
      created() { }
    })
  </script>
  

<!-- 图片懒加载 -->
<script defer src="https://unpkg.com/vanilla-lazyload@17.1.0/dist/lazyload.min.js"></script>
<script>
  // https://www.npmjs.com/package/vanilla-lazyload
  // Set the options globally
  // to make LazyLoad self-initialize
  window.lazyLoadOptions = {
    elements_selector: ".lazyload",
    threshold: 0
  };
  // Listen to the initialization event
  // and get the instance of LazyLoad
  window.addEventListener(
    "LazyLoad::Initialized",
    function (event) {
      window.lazyLoadInstance = event.detail.instance;
    },
    false
  );
  document.addEventListener('DOMContentLoaded', function () {
    lazyLoadInstance.update();
  });
  document.addEventListener('pjax:complete', function () {
    lazyLoadInstance.update();
  });
</script>


<!-- 卡片滚动动画 -->

    <script type="text/javascript">
  loadScript("https://unpkg.com/scrollreveal@4.0.6/dist/scrollreveal.min.js")
  function pjax_scrollrebeal() {
    ScrollReveal().reveal('.reveal', {
      distance: '120px',
      duration: '400',
      interval: '30',
      scale: '1',
      origin: 'bottom', // 动画开始的方向
      easing: 'ease'
    });
  }
  $(function () {
    var checkScrollReveal = setInterval(function () {
      if ($("#safearea").css("display") != "block") return
      if (typeof ScrollReveal == "undefined") return
      clearInterval(checkScrollReveal)
      pjax_scrollrebeal();
    }, 100)
  });
  document.addEventListener('pjax:complete', function () {
    pjax_scrollrebeal();
  })
</script>
   

<!-- 评论所需js -->

  
    <!-- 弹幕所需的css和js -->
    
  <!-- 弹幕插件 -->
  <link href="/js/danmu/barrager.css" rel="stylesheet">
  <script src="/js/danmu/jquery.barrager.js"></script>

<!-- 具体js，请前往valine/script.ejs查看 -->

    <script>
  var requiredFields = 'nick';
  requiredFields = requiredFields.split(',');
  comment_el = '.comment';
  let looperValine = null;
  load_valine = function () {
    if ($(comment_el).length) {
      var valine = new Valine({
        el: '#vcomment',
        path: window.location.pathname,
        notify: false,
        verify: false,
        app_id: "HvvYcruryPsiW2egxIpRnlKV-gzGzoHsz",
        app_key: "MLKN1tH2RNDMR4e3O9PJgAh5",
        placeholder: "客官，说点什么吧（如果想让我及时收到的话可以连续发送两遍，会触发邮件提醒机制）",
        avatar: "wavatar",
        master: "3d28ff93d17df2e86f7971eda5159791",   //博主邮箱md5
        tagMeta: ["博主","小伙伴","访客"],     //标识字段名
        friends: "8b42635701290c05327f3faba356ce6e",
        metaPlaceholder: { "nick": "昵称/QQ号", "mail": "邮箱" },
        requiredFields: requiredFields,
        enableQQ: true,
      });
      function debounce(fn) {
        var timerID = null
        return function () {
          var arg = arguments[0]   //获取事件
          if (timerID) {
            clearTimeout(timerID)
          }
          timerID = setTimeout(function () {
            fn(arg)              //事件传入函数
          }, 200)
        }
      }
      //查询评论 valine.Q('*').limit(7) -- 查询所有，限制7条, 下面的的代码是查询当前页面
      var themeDanmu = eval('true');
      var themeLoop = eval('false');
      var themeLooperTime = '5000' || 5000;
      var speed = '20' || 20;
      var isBarrager = true;
      if (themeDanmu == true) {
        do_barrager();
        if ($('.danmuBox').length <= 0) {
          $('.navbar').append('<div class="danmuBox"><div class="danmuBtn open"><span class="danmuCircle"></span><span class="danmuText">弹幕</span></div></div>');
        }
        $('.danmuBtn').on('click', debounce(
          function () {
            if ($('.danmuBtn').hasClass('open')) {
              $('.danmuBtn').removeClass('open')
              clearInterval(looperValine);
              $.fn.barrager.removeAll();
            } else {
              $('.danmuBtn').addClass("open");
              do_barrager();
            }
          }
        ))
      }
      function do_barrager() {
        isBarrager && valine.Q(window.location.pathname).find().then(function (comments) {
          // var num = 0; // 可以记录条数，循环调用的时候只取最新的评论放入弹幕中
          var run_once = true;
          var looper_time = themeLooperTime;
          var total = comments.length;
          // var looper = null;
          var index = 0;
          if (total > 0) {
            barrager();
          } else {
            // 当评论数为0的时候，自动关闭弹幕
            // $('.danmuBtn').removeClass('open');
          }
          function barrager() {
            if (run_once) {
              //如果是首次执行,则设置一个定时器,并且把首次执行置为false
              looperValine = setInterval(barrager, looper_time);
              run_once = false;
            }
            var content = comments[index]._serverData.comment;
            var email = comments[index]._serverData.mail;
            var link = comments[index]._serverData.link;
            var newcontent = content.substring(0, 50).replace(/<[^>]+>/g, "");
            //发布一个弹幕
            const item = {
              img: `https://q1.qlogo.cn/g?b=qq&nk=${email}&s=640`, //图片 
              info: newcontent, //文字 
              href: link, //链接 
              close: true, //显示关闭按钮 
              speed: speed, //延迟,单位秒,默认6 
              color: '#fff', //颜色,默认白色 
              old_ie_color: '#000000', //ie低版兼容色,不能与网页背景相同,默认黑色
            }
            $('body').barrager(item);
            //索引自增
            index++;
            //所有弹幕发布完毕，清除计时器。
            if (index == total) {
              clearInterval(looperValine);
              if (themeLoop === true) {
                setTimeout(function () {
                  do_barrager();
                }, 5000);
              } else {
                $('.danmuBtn').removeClass('open');
              }
              return false;
            }

          }
        })
      }
    }
  };
  $(document).ready(load_valine);
  document.addEventListener('pjax:send', function (e) {
    
      $('.danmuBox').length > 0 && $('.danmuBox').remove()
      looperValine && clearInterval(looperValine);
      $.fn.barrager.removeAll();
    
  })
  document.addEventListener('pjax:complete', function () {
    load_valine();
  });
</script>

  


<!-- 鼠标点击特效 -->
<!-- 爱心点击 -->

  
    <script src="/js/cursor/fireworks.js"></script>
  




  <script async src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js" data-pjax></script>


    <!-- pjax -->
    

<!-- pjax -->


  <script src="/js/pjax@0.2.8/index.js"></script>
  
    <!-- 样式位于：source/css/_third-party/pjaxanimate.styl -->

<div class="pjax-animate">
  
    <div class="loading-circle"><div id="loader-circle"></div></div>
    <script>
      window.ShowLoading = function() {
        $(".loading-circle").css("display", "block");
      };
      window.HideLoading = function() {
        $(".loading-circle").css("display", "none");
      }
    </script>
  
	<script>
    document.addEventListener('pjax:complete', function () {
      window.HideLoading();
    })
    document.addEventListener('pjax:send', function () {
      window.ShowLoading();
    })
    document.addEventListener('pjax:error', function () {
      window.HideLoading();
    })
	</script>
</div>

  

  <script>
    var pjax = new Pjax({
      elements: 'a[href]:not([href^="#"]):not([href="javascript:void(0)"]):not([no-pjax])',   // 拦截正常带链接的 a 标签
      selectors: ["#pjax-container","title"],                                   // 根据实际需要确认重载区域
      cacheBust: false,   // url 地址追加时间戳，用以避免浏览器缓存
      timeout: 5000
    });

    document.addEventListener('pjax:send', function (e) {

      try {
        var currentUrl = window.location.pathname;
        var targetUrl = e.triggerElement.href;
        var banUrl = [""];
        if (banUrl[0] != "") {
          banUrl.forEach(item => {
            if(currentUrl.indexOf(item) != -1 || targetUrl.indexOf(item) != -1) {
              window.location.href = targetUrl;
            }
          });
        }
      } catch (error) {}

      $(window).unbind('resize');
      $(window).unbind('scroll');
      $(document).unbind('scroll');
      $(document).unbind('click');
      $('body').unbind('click');

    })
    
    document.addEventListener('pjax:complete', function () {
      $('script[data-pjax], .pjax-reload script').each(function () {
        $(this).parent().append($(this).remove());
      });
    });

    document.addEventListener('pjax:error', function (e) {
      window.location.href = e.triggerElement.href;
    })
    
    // 刷新不从顶部开始
    document.addEventListener("DOMContentLoaded", function () {
      history.scrollRestoration = 'auto';
    })
  </script>



  </body>
</html>